CWE-528 is a product that generates a core dump file in a directory, archive or other resource that is stored, transferred or otherwise made accessible to unauthorized actors.
How it happens
When a process crashes, the system can write its memory to a file. That memory can hold keys, passwords, session data and anything else the process had loaded. The weakness appears when the dump lands somewhere others can reach: a web root, a shared folder, a world readable directory, a support bundle sent to a third party, or an archive that gets uploaded.
The record includes a real example. CVE-2024-10403 is described as SAN firmware whose operating system includes an SFTP or FTP server password in a core dump.
What an attacker gains
MITRE lists reading application data and reading files or directories. An attacker who gets a dump does not need to break in. They read what the process held at the moment it crashed.
How to find it
Static analysis can find some instances. Operationally, check where your systems write dumps and who can read those locations:
cat /proc/sys/kernel/core_pattern
ls -l /var/crash 2>/dev/null
Also look in release archives, container images and support bundles for files named core or core.<pid>.
How to fix it
MITRE's mitigation is to protect the core dump files from unauthorized access. In practice:
- Write dumps to a directory only the service account or administrators can read.
- Keep dump locations out of anything served or shared.
- Disable dumps for processes that hold secrets, if you do not need them.
- Delete dumps after analysis, and scrub them before sending them outside.
- Exclude dump files from images and archives with ignore rules.
Quick check
Why are core dumps sensitive?
They contain process memory, which can include passwords, keys and personal data.
