CVE-2025-5054: 
Linux Ubuntu vulnerability analysis and mitigation

Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. The vulnerability was discovered in May 2025 and affects Ubuntu's core-dump handler. When handling a crash, the function _check_global_pid_and_forward, which detects if the crashing process resided in a container, was being called before consistency_checks, which attempts to detect if the crashing process had been replaced (Ubuntu CVE, NVD).

The vulnerability exists due to incorrect handling of metadata when processing application crashes. The issue occurs because the container detection function is called before consistency checks are performed. If a process crashes and is quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. The vulnerability has been assigned a CVSS 3.1 score of 4.7 (Medium) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (Qualys Report).

The vulnerability allows local attackers to obtain sensitive information from core dumps of privileged processes. Specifically, attackers can access password hashes from /etc/shadow by exploiting core dumps of crashed SUID programs like unix_chkpwd. The impact is primarily limited to confidentiality breaches of privileged process memory (Hacker News, Qualys Report).

The vulnerability has been patched in multiple Ubuntu releases with updated versions of the apport package. As a temporary mitigation, systems can set /proc/sys/fs/suid_dumpable to 0, which prevents all SUID programs from being analyzed in case of a crash. The fix involves calling consistency_checks before _check_global_pid_and_forward and implementing additional checks for crash forwarding to containers (Ubuntu Security Notice).

The security community has noted this as part of a broader set of vulnerabilities affecting core dump handlers in Linux distributions. The vulnerability was discovered by Qualys Threat Research Unit and coordinated with Ubuntu's security team and apport's developers. The disclosure process involved multiple stakeholders including Red Hat Product Security and the linux-distros@openwall group (Hacker News).