Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux11.0
• debian debian linux12.0
• linux linux kernelbefore 6.16
• oracle linux8
• oracle linux9
• redhat enterprise linux10.0
• redhat enterprise linux7.0
• redhat enterprise linux8.0
• redhat enterprise linux9.0
• redhat openshift container platform4.0
• systemd project systemd256 and later · before 256.14
• systemd project systemd255 and later · before 255.19
• systemd project systemd254 and later · before 254.25
• systemd project systemdbefore 252.37
• systemd project systemd253 and later · before 253.32
• systemd project systemd257 and later · before 257.6

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• github.com/systemd/systemd systemd-coredump

  • before 252.37affected · semver
  • 253.0 and later · before 253.32affected · semver
  • 254.0 and later · before 254.25affected · semver
  • 255.0 and later · before 255.19affected · semver
  • 256.0 and later · before 256.14affected · semver
  • 257.0 and later · before 257.6affected · semver

• Red Hat Red Hat Ceph Storage 7

  • 7 and laternot affected · rpm

• Red Hat Red Hat Ceph Storage 8

  • 8 and laternot affected · rpm
  • 1769512383 and laternot affected · rpm

• Red Hat Red Hat Discovery 2

  • 1767888970 and laternot affected · rpm
  • 1767904573 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 10

  • 0:257-23.el10 and laternot affected · rpm
  • all versionsunknown
  • all versionsunknown

• Red Hat Red Hat Enterprise Linux 7

  • all versionsunknown
  • all versionsaffected

• Red Hat Red Hat Enterprise Linux 8

  • all versionsaffected

• Red Hat Red Hat Enterprise Linux 9

  • 0:252-55.el9_7.7 and laternot affected · rpm
  • 0:252-55.el9_7.7 and laternot affected · rpm
  • all versionsunknown

• Red Hat Red Hat Insights proxy 1.5

  • 1.5.9-1765201856 and laternot affected · rpm

• Red Hat Red Hat OpenShift Container Platform 4

  • all versionsunknown
  • all versionsaffected
  • all versionsunknown

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-9445In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small.
  46Plan
• CVE-2018-21029systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS.
  40Plan
• CVE-2015-7510Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
  40Plan

Published before and after this one in the same product

• ← EarlierCVE-2023-31439Jun 13, 2023 · An issue was discovered in systemd 253.
  21Monitor
• ← EarlierCVE-2023-7008Dec 23, 2023 · Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes
  23Monitor
• Later →CVE-2026-29111Mar 23, 2026 · systemd: Local unprivileged user can trigger an assert
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.