CVE-2025-54409

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a	Patch
https://github.com/aide/aide/releases/tag/v0.19.2	Release Notes
https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh	Exploit Mitigation Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/08/14/8
https://lists.debian.org/debian-lts-announce/2025/08/msg00011.html
https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:*

History

04 Nov 2025, 22:16

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2025/08/14/8 - () https://lists.debian.org/debian-lts-announce/2025/08/msg00011.html -
References	~~() https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh - Exploit, Vendor Advisory, Mitigation~~	() https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh - Exploit, Mitigation, Vendor Advisory

Information

Published : 2025-08-14 16:15

Updated : 2025-11-04 22:16

NVD link : CVE-2025-54409

Mitre link : CVE-2025-54409

CVE.ORG link : CVE-2025-54409

JSON object : View

Products Affected

advanced_intrusion_detection_environment_project

advanced_intrusion_detection_environment

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-54409", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-08-14T16:15:39.397", "references": [{"url": "https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/aide/aide/releases/tag/v0.19.2", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2025/08/14/8", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00011.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems."}, {"lang": "es", "value": "AIDE es un entorno avanzado de detecci\u00f3n de intrusiones. Desde la versi\u00f3n 0.13 hasta la 0.19.1, existe una vulnerabilidad de desreferencia de puntero nulo en AIDE. Un atacante puede bloquear el programa durante la impresi\u00f3n de informes o el listado de bases de datos tras configurar atributos de archivo extendidos con un valor de atributo vac\u00edo o con una clave que contenga una coma. Un usuario local podr\u00eda explotar esto para provocar una denegaci\u00f3n de servicio local. Este problema se ha corregido en la versi\u00f3n 0.19.2. Una soluci\u00f3n alternativa consiste en eliminar el grupo xattrs de las reglas que coinciden con los archivos de los sistemas de archivos afectados."}], "lastModified": "2025-11-04T22:16:28.043", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "039F8014-AB86-48F2-8231-DE5AEE889903", "versionEndExcluding": "0.19.2", "versionStartIncluding": "0.13"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}