Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 252.37, 253.32, 254.25, 255.19, 256.14, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- systemd-coredump
fixed in 252.37; From 253.0 · fixed in 253.32; From 254.0 · fixed in 254.25; From 255.0 · fixed in 255.19; From 256.0 · fixed in 256.14; From 257.0 · fixed in 257.6
- systemd
Version range not reported
- systemd
Version range not reported
- rhceph/rhceph-7-rhel9
Version range not reported
- rhceph/rhceph-8-rhel9
Version range not reported
- discovery/discovery-server-rhel9
Version range not reported
- discovery/discovery-ui-rhel9
Version range not reported
- insights-proxy/insights-proxy-container-rhel9
Version range not reported
- NetworkManager
Version range not reported
- rpm-ostree
Version range not reported
- NetworkManager
Version range not reported
- systemd
Version range not reported
- systemd
Version range not reported
- NetworkManager
Version range not reported
- openshift/ose-rhel-coreos-8
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- systemd
Version range not reported