CVE-2025-5054: Core-Dump Password Hash Theft Vulnerability in Ubuntu

By /

Listen to this Post

Featured Image
A critical vulnerability, CVE-2025-5054, has been disclosed, allowing attackers to steal password hashes via core dumps in Ubuntu. The flaw was promptly patched by Ubuntu, with fixes released even before public disclosure.

Affected Systems:

  • Ubuntu Linux (patched in latest updates)
  • Related Red Hat CVE: CVE-2025-4098

Read More:

You Should Know:

How Attackers Exploit Core Dumps to Steal Hashes

Core dumps, generated during crashes, may contain sensitive data, including password hashes. Attackers can trigger crashes to extract these hashes for offline cracking.

Mitigation Steps (Linux Commands & Configurations)

1. Disable Core Dumps System-Wide:

echo " hard core 0" | sudo tee -a /etc/security/limits.conf 
sudo sysctl -w kernel.core_pattern=/dev/null

2. Check for Existing Core Dumps:

find / -name "core." -type f -exec ls -la {} \;

3. Restrict Core Dumps for Specific Services:

systemctl set-property <service_name> LimitCore=0

4. Verify Kernel Settings:

sysctl kernel.core_pattern 
ulimit -c

5. Enable ASLR (Address Space Layout Randomization):

sudo sysctl -w kernel.randomize_va_space=2

6. Audit Crash Logs:

journalctl -xe --no-pager | grep -i "segfault|core dumped"

Red Hat/CentOS Specific Fixes:

sudo yum update kernel -y 
sudo grubby --update-kernel=ALL --args="noreplace-smp"

What Undercode Say:

This vulnerability highlights the risks of unsecured core dumps in Linux systems. Immediate patching and hardening are critical. Attackers increasingly target memory leaks and crash dumps, making system hardening a priority.

Expected Output:

  • No core dumps generated (ulimit -c shows 0).
  • Kernel logs confirm ASLR is active (cat /proc/sys/kernel/randomize_va_space returns 2).
  • No sensitive data leakage in /var/crash/.

Prediction:

Future Linux kernel updates may enforce stricter core dump permissions by default, reducing such attack surfaces. Expect more CVEs related to memory handling in 2025-2026.

(End of Report)

IT/Security Reporter URL:

Reported By: Charlescrampton Thn – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: