CVE-2025-5054
published 2025-05-30CVE-2025-5054: Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces…
PriorityP422medium4.7CVSS 3.1
AVLACHPRLUINSUCHINAN
EPSS
0.67%
47.8th percentile
Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces.
When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only forwarded to containers if the kernel provided a pidfd, or if the crashing process was unprivileged (i.e., if dump mode == 1).
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apport_project | apport | >= 0 < 2.20.11-0ubuntu27.28 | 2.20.11-0ubuntu27.28 |
| apport_project | apport | >= 0 < 2.20.11-0ubuntu82.7 | 2.20.11-0ubuntu82.7 |
| apport_project | apport | >= 0 < 2.28.1-0ubuntu3.6 | 2.28.1-0ubuntu3.6 |
| apport_project | apport | >= 0 < 2.20.1-0ubuntu2.30+esm5 | 2.20.1-0ubuntu2.30+esm5 |
| apport_project | apport | >= 0 < 2.20.9-0ubuntu7.29+esm1 | 2.20.9-0ubuntu7.29+esm1 |
| canonical | apport | <= 2.32.0 | — |
| canonical | apport | 2.20 – 2.32.0 | — |
| canonical | apport | >= 2.20.1 < 2.20.1-0ubuntu2.30+esm5 | 2.20.1-0ubuntu2.30+esm5 |
| canonical | apport | >= 2.20.11 < 2.20.11-0ubuntu27.28 | 2.20.11-0ubuntu27.28 |
| canonical | apport | >= 2.20.11 < 2.20.11-0ubuntu82.7 | 2.20.11-0ubuntu82.7 |
| canonical | apport | >= 2.20.9 < 2.20.9-0ubuntu7.29+esm1 | 2.20.9-0ubuntu7.29+esm1 |
| canonical | apport | >= 2.28.1 < 2.28.1-0ubuntu3.6 | 2.28.1-0ubuntu3.6 |
| canonical | apport | >= 2.30.0 < 2.30.0-0ubuntu4.3 | 2.30.0-0ubuntu4.3 |
| canonical | apport | >= 2.32.0 < 2.32.0-0ubuntu5.1 | 2.32.0-0ubuntu5.1 |
| canonical | apport | >= 2.32.0 < 2.33.0-0ubuntu1 | 2.33.0-0ubuntu1 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
osv4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Apport vulnerability
vendor_ubuntu·2025-05-29
CVE-2025-5054 Apport vulnerability
Title: Apport vulnerability
Summary: Apport could be made to leak sensitive information.
Qualys discovered that Apport incorrectly handled metadata when
processing application crashes. An attacker could possibly use this issue
to leak sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
GHSA
The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended
ghsa·2025-08-06
CVE-2025-54885 [MEDIUM] CWE-331 The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended
The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended
### Impact
A protocol compliance bug in thinbus-srp-npm versions prior to 2.0.1 causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). RFC 5054 states in section [2.5.4 Client Key Exchange ](https://datatracker.ietf.org/doc/html/rfc5054#section-2.5.4)
> The client key exchange message carries the client's public value
(A). The client calculates this value as A = g^a % N, where a is a
random number that SHOULD be at least 256 bits in length.
The client public value is being generated from a private value that is 4 bits below the specification. This reduces the protocol's designed security margin it is no
GHSA
GHSA-4c8w-67qj-c8vp: Race condition in Canonical apport up to and including 2
ghsa_unreviewed·2025-05-30
CVE-2025-5054 [MEDIUM] CWE-362 GHSA-4c8w-67qj-c8vp: Race condition in Canonical apport up to and including 2
Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces.
When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only
OSV
CVE-2025-5054: Race condition in Canonical apport up to and including 2
osv·2025-05-29·CVSS 4.7
CVE-2025-5054 [MEDIUM] CVE-2025-5054: Race condition in Canonical apport up to and including 2
Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only f
No detection rules found.
No public exploits indexed.
Schneier
New Linux Vulnerabilities
blogs_schneier·2025-06-03·CVSS 4.7
CVE-2025-5054 [MEDIUM] New Linux Vulnerabilities
## New Linux Vulnerabilities
They’re interesting :
Tracked as CVE-2025-5054 and CVE-2025-4598 , both vulnerabilities are race condition bugs that could enable a local attacker to obtain access to access sensitive information. Tools like Apport and systemd-coredump are designed to handle crash reporting and core dumps in Linux systems.
[…]
“This means that if a local attacker manages to induce a crash in a privileged process and quickly replaces it with another one with the same process ID that resides inside a mount and pid namespace, apport will attempt to forward the core dump (which might contain sensitive information belonging to the original, privileged process) into the namespace.”
Moderate severity, but definitely worth fixing.
Slashdot thread .
Tags: Linux , passwords , vuln
Qualys
Qualys TRU Discovers Two Local Information Disclosure Vulnerabilities in Apport and systemd-coredump: CVE-2025-5054 and CVE-2025-4598 | Qualys
blogs_qualys·2025-05-29·CVSS 4.7
CVE-2025-5054 [MEDIUM] Qualys TRU Discovers Two Local Information Disclosure Vulnerabilities in Apport and systemd-coredump: CVE-2025-5054 and CVE-2025-4598 | Qualys
#### Table of Contents
- What is systemd-coredump and Apport (Crash Reporting on Linux)?
- Technical Details
- Qualys QID Coverage
- Leverage Qualys TruRisk Eliminate to Mitigate These Risks
The Qualys Threat Research Unit (TRU) has discovered two local information-disclosure vulnerabilities in Apport and systemd-coredump.
Both issues are race-condition vulnerabilities. The first (CVE-2025-5054) affects Ubuntu’s core-dump handler, Apport, and the second (CVE-2025-4598) targets systemd-coredump, which is the default core-dump handler on Red Hat Enterprise Linux 9 and the recently released 10, as well as on Fedora. These race conditions allow a local attacker to exploit a SUID program and gain read access to the resulting core dump.
Qualys TRU has developed proofs of concept (POCs) for c
Qualys
Qualys TRU Discovers Two Local Information Disclosure Vulnerabilities in Apport and systemd-coredump: CVE-2025-5054 and CVE-2025-4598
blogs_qualys·2025-05-29·CVSS 4.7
CVE-2025-5054 [MEDIUM] Qualys TRU Discovers Two Local Information Disclosure Vulnerabilities in Apport and systemd-coredump: CVE-2025-5054 and CVE-2025-4598
## Table of Contents
What is systemd-coredump and Apport (Crash Reporting on Linux)?
Technical Details
Qualys QID Coverage
Leverage Qualys TruRisk Eliminate to Mitigate These Risks
The Qualys Threat Research Unit (TRU) has discovered two local information-disclosure vulnerabilities in Apport and systemd-coredump.
Both issues are race-condition vulnerabilities. The first (CVE-2025-5054) affects Ubuntu’s core-dump handler, Apport , and the second (CVE-2025-4598) targets systemd-coredump , which is the default core-dump handler on Red Hat Enterprise Linux 9 and the recently released 10, as well as on Fedora. These race conditions allow a local attacker to exploit a SUID program and gain read access to the resulting core dump.
Qualys TRU has developed proofs of concept (POCs) for certai
2025-05-30
Published