Key points
- AIDE versions 0.16 through 0.19.4 ignore files with invalid UTF-8 names.
- AIDE versions up to 0.19.4 ignore hash changes if a null byte appears in the value.
- Both flaws allow local users to bypass intrusion detection silently.
The Advanced Intrusion Detection Environment, known as AIDE, has two vulnerabilities that let local attackers hide changes from the system. Affected versions include 0.16 up to and including 0.19.4. No patch or fix has been confirmed by the vendor yet.
In plain English
AIDE checks file integrity by comparing current states against known good baselines. The first flaw lets attackers create files with names containing invalid UTF-8 bytes. AIDE silently ignores these files, so malicious content added to them is not detected. The second flaw involves how AIDE compares hash values.
The background
If a file hash contains a null byte, AIDE may stop comparing early. An attacker can craft a file where the new hash matches the old one up to the first null byte. The system then assumes the file is unchanged, even if the rest of the hash differs. This allows modified files to pass integrity checks.
What changes now
Both issues were reported by researcher Rajesh Pangare and posted by Hannes von Haugwitz on October 22. They are tracked as GHSA-wq25-fm54-5q3q and GHSA-6wc9-4w69-5jc5. No CVE IDs have been assigned yet. The flaws require local access to exploit, meaning an attacker must already have some presence on the system.
Who needs to act first
Teams should prioritize updating systems exposed to untrusted local users or shared multi-user environments. Roll out changes gradually, starting with the most sensitive servers. Test the integrity checker in a non-production environment first. Back up configuration files before making any changes. Monitor logs for unusual file activity while waiting for a vendor update.
What to do and how to stay safe: AIDE
- Check if your systems run AIDE version 0.16 through 0.19.4.
- Look for files with unusual or non-standard characters in their names.
- Review recent integrity check logs for skipped or ignored entries.
- Once the vendor provides an update, apply it promptly to all affected hosts.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AIDE versions are affected by these flaws?
Versions 0.16 through 0.19.4 are affected by both vulnerabilities.
Can remote attackers exploit these issues?
No, the flaws require local access to the system to exploit.
Is there a patch available for these vulnerabilities?
No, no fix has been confirmed by the vendor yet.
