Potential Exploitation of CVE-2025-5054 or CVE-2025-4598

Status: experimental
Severity: medium
Log source: category process_creation, product linux
Author: Milad Cheraghi
Source: github.com/SigmaHQ/sigma

Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2. Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges. These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets. CVE-2025-5054: Information leak via core dumps from SUID binaries using apport. CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.

Known false positives

System administrators enabling debugging temporarily
Legitimate crash diagnostic operations

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548` Abuse Elevation Control Mechanism
Credential Access	`T1003` OS Credential Dumping

Telemetry coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule body

title: Potential Exploitation of CVE-2025-5054 or CVE-2025-4598
id: 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
status: experimental
description: |
    Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
    Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
    These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
    CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
    CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5054
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4598
    - https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598
author: Milad Cheraghi
date: 2026-04-28
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.t1548
    - attack.t1003
    - cve.2025-5054
    - cve.2025-4598
    - detection.emerging-threats
logsource:
    product: linux
    category: process_creation
detection:
    selection_suid_dumpable_sysctl:
        Image|endswith:
            - '/sbin/sysctl'
            - '/bin/sysctl'
        CommandLine|contains: 'fs.suid_dumpable='
    selection_echo_proc_write:
        Image|endswith:
            - '/bin/bash'
            - '/bin/sh'
        CommandLine|contains:
            - 'echo 1 > /proc/sys/fs/suid_dumpable'
            - 'echo 2 > /proc/sys/fs/suid_dumpable'
            - 'echo 1 >/proc/sys/fs/suid_dumpable'
            - 'echo 2 >/proc/sys/fs/suid_dumpable'
            - 'echo 1> /proc/sys/fs/suid_dumpable'
            - 'echo 2> /proc/sys/fs/suid_dumpable'
            - 'echo 1>/proc/sys/fs/suid_dumpable'
            - 'echo 2>/proc/sys/fs/suid_dumpable'
    condition: 1 of selection_*
falsepositives:
    - System administrators enabling debugging temporarily
    - Legitimate crash diagnostic operations
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_suid_dumpable_sysctl`

selection_suid_dumpable_sysctl:
    Image|endswith:
        - '/sbin/sysctl'
        - '/bin/sysctl'
    CommandLine|contains: 'fs.suid_dumpable='

Stage 2: `selection_echo_proc_write`

selection_echo_proc_write:
    Image|endswith:
        - '/bin/bash'
        - '/bin/sh'
    CommandLine|contains:
        - 'echo 1 > /proc/sys/fs/suid_dumpable'
        - 'echo 2 > /proc/sys/fs/suid_dumpable'
        - 'echo 1 >/proc/sys/fs/suid_dumpable'
        - 'echo 2 >/proc/sys/fs/suid_dumpable'
        - 'echo 1> /proc/sys/fs/suid_dumpable'
        - 'echo 2> /proc/sys/fs/suid_dumpable'
        - 'echo 1>/proc/sys/fs/suid_dumpable'
        - 'echo 2>/proc/sys/fs/suid_dumpable'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`echo 1 > /proc/sys/fs/suid_dumpable` `echo 1 >/proc/sys/fs/suid_dumpable` `echo 1> /proc/sys/fs/suid_dumpable` `echo 1>/proc/sys/fs/suid_dumpable` `echo 2 > /proc/sys/fs/suid_dumpable` `echo 2 >/proc/sys/fs/suid_dumpable` `echo 2> /proc/sys/fs/suid_dumpable` `echo 2>/proc/sys/fs/suid_dumpable` `fs.suid_dumpable=`	`field:"CommandLine" kind:match`
`Image`	ends_with	`/bin/bash` `/bin/sh` `/bin/sysctl` `/sbin/sysctl`	`field:"Image" kind:ends_with`