AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Summary =======

Rajesh Pangare discovered a null pointer dereference vulnerability in AIDE, an advanced intrusion detection system. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service.

Project =======

AIDE (https://aide.github.io)

Affected versions =================

AIDE >= 0.13, <= 0.19.1

CVE ID ======

CVE-2025-54409

Proof of concept ================

To take advantage of the flaw the user needs write access to a mounted file system that supports extended file attributes. aide also needs to be compiled with --with-xattr configure flag (this is the case for most distributions).

listing aide database with empty extended attribute value $ touch xattrs-file ; setfattr -n user.emptyvalue xattrs-file # aide --config <(printf -- "databaseout=stdout\n$(pwd)/xattrs-file xattrs\n") --init | aide --config <(printf -- "databasein=stdin\n$(pwd)/xattrs-file xattrs\n") --list

checking aide database with extended attribute key containing a comma $ touch xattrs-file ; setfattr -n user.ke,y -v value xattrs-file # aide --config <(printf -- "databaseout=stdout\n$(pwd)/xattrs-file xattrs\n") --init | aide --config <(printf -- "databasein=stdin\n$(pwd)/xattrs-file xattrs\n") --check

Please note that the segfault only occurs on the second run of aide after the extended file attribute has been written to the database in the first run (provided the xattr value is shown in the report due to a change or the database is listed via --list).

Analysis ========

The vulnerability is caused by missing error handling while decoding the base64 encoded xattr attribute from the database and incorrectly handling of empty xattr attribute values and attribute keys containing a comma.

This allows a user to craft a file with an extended file attribute causing aide to dereference a null pointer and segfault.

Mitigation ==========

Upgrade to AIDE v0.19.2 [v0.19.2]

Alternatively apply one of the provided patches:

aide-0.19cve-2025-54409xattr.patch for 0.19.1 aide-0.18cve-2025-54409xattr.patch for 0.18.8 (backported for Debian Bookworm) aide-0.17cve-2025-54409xattr.patch for 0.17.4 (backported for Debian Bullseye)

If you cannot upgrade, consider removing xattrs group from rules matching files on affected file systems.

[v0.19.2] https://github.com/aide/aide/releases/tag/v0.19.2

Credit ======

The issue was reported by Rajesh Pangare.

Summary =======

Rajesh Pangare discovered an improper output neutralization vulnerability in AIDE, an advanced intrusion detection system. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized.

Project =======

AIDE (https://aide.github.io)

Affected versions =================

AIDE <= 0.19.1

CVE ID ======

CVE-2025-54389

Proof of concept ================

$ mkdir test $ touch test/$(echo -e 'malicious-file\033[1A') $ touch test/regular-testfile $ aide --config <(printf -- "databasein=file:/dev/null\nrootprefix = ./test\n/ R") --check Start timestamp: 2025-08-10 07:23:25 +0000 (AIDE 0.19.1) AIDE found differences between database and filesystem!! Root prefix: ./test

Summary: Total number of entries: 3 Added entries: 3 Removed entries: 0 Changed entries: 0

--------------------------------------------------- Added entries: ---------------------------------------------------

d++++++++++++++++++: / f++++++++++++++++++: /regular-testfile

--------------------------------------------------- The attributes of the (uncompressed) database(s): ---------------------------------------------------

/dev/null SHA256 : 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NM pJWZG3hSuFU= SHA512 : z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXc g/SpIdNs6c5H0NE8XYXysP+DGNKHfuwv Y7kxvUdBeoGlODJ6+SfaPg== STRIBOG256: P1OaIT6XyALMIp1HTGqjKoJaNgsqkzqU n9klII2c4bs= STRIBOG512: jpRdogmqhp8EVZKFKbyuRnnphzq3B7VT FfVs65i+8Kc2L3FVKDVu6DzaXyqsTGrS ujpxXBvNgcuOn5C/TBwaig== SHA512/256: xnK40e9W7Sirh8NiLFEUBpvdOte4+XN0 mNDAHs7wlno= SHA3-256 : p//G+L8e12ZRwUdWoGHWYvWA/03kO0n6 gtgKS4D4Q0o= SHA3-512 : pp9zzKI6msXItWfcGFp1bpfJghZP4lhZ 4NHcwUdcgKYVshI68fX5TBHj6UAsOsVY 9QAZnZW20+MBdYWGKB3NJg==

End timestamp: 2025-08-10 07:23:25 +0000 (run time: 0m 0s)

The output correctly shows the addition of regular-testfile but misses the addition of the malicious file.

This works because the terminal escape sequence moves the cursor one line up before the new line character of the regular output moves the cursor back to the beginning of the line containing the malicious file; the next added entry then overwrites the line.

Please note that the number of added entries is unchanged in the report. For this POC a user might notice the difference between the number of added entries and the list of added entries shown in the report, but with a much higher number of added files the deviation is likely overlooked.

Analysis ========

The vulnerability is caused by missing output neutralization before printing the filename, symbolic link target or extended attribute key name to the report and log output.

This allows a user to craft a filename, symbolic link target or extended attribute key name including control characters to tamper with or overwrite previous output.

Mitigation ==========

Upgrade to AIDE v0.19.2 [v0.19.2]

Alternatively apply one of the provided patches:

aide-0.19cve-2025-54389controlchars.patch for 0.19.1 aide-0.18cve-2025-54389controlchars.patch for 0.18.8 (backported for Debian Bookworm) aide-0.17cve-2025-54389controlchars.patch for 0.17.4 (backported for Debian Bullseye)

If you cannot upgrade, the issue can be mitigated by configuring AIDE to write the report output to a regular file (e.g. reporturl=file:/var/log/aide.log) or redirecting stdout to a regular file. Additionally consider redirecting the log output written to stderr to a regular file. Mind to open the generated files with a program that escapes terminal sequences correctly.

[v0.19.2] https://github.com/aide/aide/releases/tag/v0.19.2

Credit ======

The issue was reported by Rajesh Pangare.

A flaw was discovered an improper output neutralization vulnerability in AIDE, an advanced intrusion detection system. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized.

A flaw was discovered an improper output neutralization vulnerability in AIDE, an advanced intrusion detection system. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized.

Description of problem: Several bugs have been fixed in recent version of aide (0.13.1) that we should pull in to RHEL5. The upstream version of aide has all but 1 of our aide patches, so rebasing would allow us to simplify things. 0.13.1 is overwhelmingly the work that we did for xattr support. But there are a few bug fixes.

Version-Release number of selected component (if applicable): aide-0.12-8.el5