Two Linux Flaws Can Lead to Sensitive Data Disclosure

Qualys has issued a warning about two information disclosure flaws in apport and systemd-coredump, the core dump handlers used by Ubuntu, Red Hat Enterprise Linux, and Fedora distributions.

The Vulnerabilities: A Threat to Confidentiality

Researchers have discovered vulnerabilities in Apport (Ubuntu's core dump handler) and another bug in systemd-coredump, which is used in the default configuration of Red Hat Enterprise Linux 9 and the Fedora distribution. These flaws, tracked as CVE-2025-5054 and CVE-2025-4598, are race condition issues that allow local attackers to exploit a SUID program and gain read access to the resulting core dump.

The Impact: A Breach of Trust

Core dumps often contain sensitive data, such as passwords, encryption keys, or customer information. When these files are accessed by an unauthorized user, it can lead to severe consequences, including operational downtime, reputational damage, and potential non-compliance with regulations.

The Vulnerable Systems: A List of Affected Distributions

Debian is not vulnerable by default, but Ubuntu 24.04 and all versions since 16.04 (up to version 2.33.0) are affected. Red Hat Enterprise Linux 9 and 10, as well as Fedora 40/41, are also impacted by the systemd-coredump vulnerability.

Preventing Data Leaks: A Temporary Fix

To prevent data leaks in crashes, setting `/proc/sys/fs/suid_dumpable` to `0` disables core dumps for SUID programs. This is a temporary fix if patches aren't available. However, it's essential to prioritize patching and mitigations, enforcing robust monitoring, and tightening access controls to effectively mitigate the risks associated with these vulnerabilities.

Conclusion: Prioritizing Security Measures

The exploitation of vulnerabilities in Apport and systemd-coredump can severely compromise confidentiality. Enterprises should adopt proactive security measures by prioritizing patches and mitigations, enforcing robust monitoring, and tightening access controls to prevent such breaches. By doing so, they can ensure the confidentiality, integrity, and availability of sensitive data.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon for the latest cybersecurity news and updates.