SB2026102810 - Multiple vulnerabilities in AIDE

Description

This security bulletin contains information about 2 vulnerabilities.

1) Partial String Comparison (CVE-ID: N/A)

CWE-ID: CWE-187 - Partial String Comparison

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass AIDE detection of malicious file changes.

The vulnerability exists due to improper partial comparison of hash values in the bytecmp function when checking file integrity. A remote attacker can craft a modified file whose hash matches the stored hash in every byte up to and including the first null byte to cause the hash change to be silently ignored. The function uses strncmp instead of memcmp, so bytes after the null byte are not compared.

2) Improper handling of exceptional conditions (CVE-ID: N/A)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass AIDE integrity checks and hide malicious files or directories from detection.

The vulnerability exists due to improper handling of UTF-8 validation errors returned by pcre2_match in AIDE's file name matching logic when evaluating file names against regular expression rules. A remote attacker can create a local file or directory with invalid UTF-8 bytes in its name to prevent it from matching any rule, causing AIDE to silently ignore it.

Remediation

Install update from vendor's website.

References

• https://github.com/aide/aide/security/advisories/GHSA-6wc9-4w69-5jc5
• https://github.com/aide/aide/security/advisories/GHSA-wq25-fm54-5q3q