AIDE through 0.19.4 can ignore hashes containing a null byte
Original title: aide (<= 0.19.4) improper comparison of hash values containing a null byte (AIDE detection bypass) [GHSA-6wc9-4w69-5jc5, CVE pending]
A local user can match a stored hash up to the first 0x00 byte and hide a changed file.
Hannes von Haugwitz reported that AIDE, a host-based file and directory integrity checker, improperly compares hash values that contain a null byte. A crafted file whose hash matches the stored value through the first 0x00 byte is treated as unchanged, so AIDE silently ignores the difference. A local user could use that to bypass detection of malicious files. Affected versions are AIDE <= 0.19.4. The issue is GHSA-6wc9-4w69-5jc5, and a CVE is still pending.
Unconfirmed: A CVE is pending, and the snippet does not name a fixed release.
- The comparison stops being reliable at the first null byte.
- The advisory identifier is GHSA-6wc9-4w69-5jc5.
- No CVE number has been assigned yet.
- The notice was posted on October 22.
Impact: Local bypass of AIDE file-integrity detection
| Product | Affected |
|---|---|
| AIDE | <= 0.19.4 |
From the original article
Posted by Hannes von Haugwitz on Oct 22 Summary ======= It was discovered that AIDE, a host-based file and directory integrity checker, improperly compares hash values containing a null byte. An attacker could craft a malicious file with a hash value matching the existing hash in every byte up to and including the first 0x00 byte so that the hash change is silently ignored by AIDE.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.