CVE-2025-54409 (GCVE-0-2025-54409)
Vulnerability from cvelistv5
Published
2025-08-14 15:52
Modified
2025-08-14 19:55
Severity ?
6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-476 - NULL Pointer Dereference
Summary
AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.
References
security-advisories@github.comhttps://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135aPatch
security-advisories@github.comhttps://github.com/aide/aide/releases/tag/v0.19.2Release Notes
security-advisories@github.comhttps://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxhExploit, Vendor Advisory, Mitigation
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxhExploit, Vendor Advisory, Mitigation
Impacted products
Vendor Product Version
aide aide Version: >= 0.13, < 0.19.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54409",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-14T18:43:34.955521Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-14T19:55:49.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "aide",
          "vendor": "aide",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.13, \u003c 0.19.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-14T15:52:24.069Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh"
        },
        {
          "name": "https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a"
        },
        {
          "name": "https://github.com/aide/aide/releases/tag/v0.19.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/aide/aide/releases/tag/v0.19.2"
        }
      ],
      "source": {
        "advisory": "GHSA-79g7-f8rv-jcxh",
        "discovery": "UNKNOWN"
      },
      "title": "AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54409",
    "datePublished": "2025-08-14T15:52:24.069Z",
    "dateReserved": "2025-07-21T23:18:10.279Z",
    "dateUpdated": "2025-08-14T19:55:49.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-54409\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-08-14T16:15:39.397\",\"lastModified\":\"2025-08-19T19:11:40.850\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.\"},{\"lang\":\"es\",\"value\":\"AIDE es un entorno avanzado de detecci\u00f3n de intrusiones. Desde la versi\u00f3n 0.13 hasta la 0.19.1, existe una vulnerabilidad de desreferencia de puntero nulo en AIDE. Un atacante puede bloquear el programa durante la impresi\u00f3n de informes o el listado de bases de datos tras configurar atributos de archivo extendidos con un valor de atributo vac\u00edo o con una clave que contenga una coma. Un usuario local podr\u00eda explotar esto para provocar una denegaci\u00f3n de servicio local. Este problema se ha corregido en la versi\u00f3n 0.19.2. Una soluci\u00f3n alternativa consiste en eliminar el grupo xattrs de las reglas que coinciden con los archivos de los sistemas de archivos afectados.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:advanced_intrusion_detection_environment_project:advanced_intrusion_detection_environment:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.13\",\"versionEndExcluding\":\"0.19.2\",\"matchCriteriaId\":\"039F8014-AB86-48F2-8231-DE5AEE889903\"}]}]}],\"references\":[{\"url\":\"https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/aide/aide/releases/tag/v0.19.2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\",\"Mitigation\"]},{\"url\":\"https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\",\"Mitigation\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-54409\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-14T18:43:34.955521Z\"}}}], \"references\": [{\"url\": \"https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-14T18:43:38.312Z\"}}], \"cna\": {\"title\": \"AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)\", \"source\": {\"advisory\": \"GHSA-79g7-f8rv-jcxh\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"aide\", \"product\": \"aide\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 0.13, \u003c 0.19.2\"}]}], \"references\": [{\"url\": \"https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh\", \"name\": \"https://github.com/aide/aide/security/advisories/GHSA-79g7-f8rv-jcxh\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a\", \"name\": \"https://github.com/aide/aide/commit/54a6d0d9d5f14b81961d66373c0291bf4af4135a\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/aide/aide/releases/tag/v0.19.2\", \"name\": \"https://github.com/aide/aide/releases/tag/v0.19.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476: NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-08-14T15:52:24.069Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-54409\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-14T19:55:49.065Z\", \"dateReserved\": \"2025-07-21T23:18:10.279Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-08-14T15:52:24.069Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.