CVE-2025-54409 (GCVE-0-2025-54409)

Vulnerability from cvelistv5 – Published: 2025-08-14 15:52 – Updated: 2025-11-04 21:12
VLAI?
Summary
AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.
Severity ?
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
aide aide Affected: >= 0.13, < 0.19.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54409",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-14T18:43:34.955521Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-14T19:55:49.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:12:46.467Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00011.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/08/14/8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aide",
          "vendor": "aide",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.13, \u003c 0.19.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-14T15:52:24.069Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh"
        },
        {
          "name": "https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a"
        },
        {
          "name": "https://github.com/aide/aide/releases/tag/v0.19.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aide/aide/releases/tag/v0.19.2"
        }
      ],
      "source": {
        "advisory": "GHSA-79g7-f8rv-jcxh",
        "discovery": "UNKNOWN"
      },
      "title": "AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54409",
    "datePublished": "2025-08-14T15:52:24.069Z",
    "dateReserved": "2025-07-21T23:18:10.279Z",
    "dateUpdated": "2025-11-04T21:12:46.467Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-54409\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-08-14T16:15:39.397\",\"lastModified\":\"2025-11-04T22:16:28.043\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.\"},{\"lang\":\"es\",\"value\":\"AIDE es un entorno avanzado de detecci\u00f3n de intrusiones. Desde la versi\u00f3n 0.13 hasta la 0.19.1, existe una vulnerabilidad de desreferencia de puntero nulo en AIDE. Un atacante puede bloquear el programa durante la impresi\u00f3n de informes o el listado de bases de datos tras configurar atributos de archivo extendidos con un valor de atributo vac\u00edo o con una clave que contenga una coma. Un usuario local podr\u00eda explotar esto para provocar una denegaci\u00f3n de servicio local. Este problema se ha corregido en la versi\u00f3n 0.19.2. Una soluci\u00f3n alternativa consiste en eliminar el grupo xattrs de las reglas que coinciden con los archivos de los sistemas de archivos afectados.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.13\",\"versionEndExcluding\":\"0.19.2\",\"matchCriteriaId\":\"039F8014-AB86-48F2-8231-DE5AEE889903\"}]}]}],\"references\":[{\"url\":\"https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/aide/aide/releases/tag/v0.19.2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/08/14/8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/08/msg00011.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/08/msg00011.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2025/08/14/8\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T21:12:46.467Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-54409\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-14T18:43:34.955521Z\"}}}], \"references\": [{\"url\": \"https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-14T18:43:38.312Z\"}}], \"cna\": {\"title\": \"AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)\", \"source\": {\"advisory\": \"GHSA-79g7-f8rv-jcxh\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"aide\", \"product\": \"aide\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 0.13, \u003c 0.19.2\"}]}], \"references\": [{\"url\": \"https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh\", \"name\": \"https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a\", \"name\": \"https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/aide/aide/releases/tag/v0.19.2\", \"name\": \"https://github.com/aide/aide/releases/tag/v0.19.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476: NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-08-14T15:52:24.069Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-54409\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-04T21:12:46.467Z\", \"dateReserved\": \"2025-07-21T23:18:10.279Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-08-14T15:52:24.069Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.