In Linux, kernel.core_pattern controls how the kernel handles a process that crashes and produces a core dump. It can specify a file for the dump or, when configured with a leading pipe character, a helper program to receive crash data. Because this setting is system-wide and can launch a program, its configuration is security-sensitive.
Attackers may abuse a writable core pattern to arrange for a helper to run with elevated privileges when a process crashes. In the embedded-system scenario described in the article, the setting was reportedly used as part of a chain involving a privileged parser and removable media. Defenders should restrict writes to this setting, review crash-handler configuration, and run parsers with only the privileges they need.