CVE-2025-4598 is a race condition vulnerability in systemd-coredump that allows a local attacker to crash a SUID process and replace it with a non-SUID binary to access the original privileged process's core dump. This can expose sensitive information loaded in memory, such as the contents of /etc/shadow. The attacker must win a race condition involving process ID recycling before systemd-coredump analyzes the auxiliary vector file. The flaw impacts confidentiality but not integrity or availability. Red Hat Enterprise Linux 8 disables core dumps for SUID binaries by default, mitigating the risk. The vulnerability is rated moderate severity by Red Hat due to exploitation complexity and required local privileges. The advisory does not confirm an official patch but provides mitigation by disabling SUID core dumps via /proc/sys/fs/suid_dumpable.

Successful exploitation allows a local unprivileged attacker to read sensitive data from the core dump of a privileged SUID process, potentially exposing confidential information such as password hashes. The vulnerability affects data confidentiality but does not impact integrity or availability. Exploitation requires local access and winning a race condition, making it moderately difficult to exploit.

Red Hat advises mitigating this vulnerability by disabling core dumps for SUID binaries using the command 'echo 0 > /proc/sys/fs/suid_dumpable' as root. This disables the ability to generate core dumps for SUID processes, preventing exposure of sensitive data through core dumps. This mitigation is effective until an official patch is released. By default, Red Hat Enterprise Linux 8 already disables SUID core dumps, providing default protection. Monitor Red Hat advisories for updates on patch availability.