From hannes at vonhaugwitz.com Thu Oct 22 17:03:38 2026 From: hannes at vonhaugwitz.com (Hannes von Haugwitz) Date: Thu, 22 Oct 2026 16:03:38 +0200 Subject: [Aide] AIDE 0.19.5 security release Message-ID: <20261022140338.GA2@magnesium.vonhaugwitz.com> AIDE version 0.19.5 was published. You can download it from https://github.com/aide/aide/releases Please ALWAYS verify the signature of a release file before using it (see README[0] for details). This is a security release. The most noteworthy changes between v0.19.4 and v0.19.5 are: * Security bug fixes - Use memcmp to compare hashsum byte sequences (GHSA-6wc9-4w69-5jc5, CVE pending) - Always treat regexes and file names as single byte sequences (GHSA-wq25-fm54-5q3q, CVE pending) Thanks to Rajesh Pangare and a community member for responsibly reporting these issues. The home URL of AIDE is http://aide.github.io Best regards Hannes [0] https://github.com/aide/aide/blob/v0.19.5/README -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 659 bytes Desc: not available URL: From hannes at vonhaugwitz.com Thu Oct 22 17:12:32 2026 From: hannes at vonhaugwitz.com (Hannes von Haugwitz) Date: Thu, 22 Oct 2026 16:12:32 +0200 Subject: [Aide] aide (>= 0.16 <= 0.19.4) improper handling of file names containing invalid UTF-8 byte sequences (AIDE detection bypass) [GHSA-wq25-fm54-5q3q, CVE pending] Message-ID: <20261022141232.GA2@magnesium.vonhaugwitz.com> Summary ======= Rajesh Pangare discovered that AIDE, a host-based file and directory integrity checker, improperly handles file names with invalid UTF-8 byte sequences. An attacker can craft a malicious file or directory name by including invalid UTF-8 bytes so that the file/directory is silently ignored by AIDE. A local user can exploit this to bypass the AIDE detection of malicious files. Project ======= AIDE (Advanced Intrusion Detection Environment) Affected versions ================= AIDE >= 0.16, <= 0.19.4 CVE ID ====== A CVE ID has been requested, but is not yet available; please cross-reference this vulnerability as GHSA-wq25-fm54-5q3q for now. The advisory will be updated, as soon as a CVE ID is available. Proof of concept ================ $ mkdir test $ touch test/"$(printf 'invalid_\x80_byte.txt')" $ touch test/regular_file.txt $ aide --config <(printf -- "database_in=file:/dev/null\nroot_prefix = ./test\n/ R") --check Start timestamp: 2026-10-17 19:30:35 +0200 (AIDE 0.19.4) AIDE found differences between database and filesystem!! Root prefix: ./test Summary: Total number of entries: 2 Added entries: 2 Removed entries: 0 Changed entries: 0 --------------------------------------------------- Added entries: --------------------------------------------------- d++++++++++++++++++: / f++++++++++++++++++: /regular_file.txt --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /dev/null SHA256 : 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NM pJWZG3hSuFU= SHA512 : z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXc g/SpIdNs6c5H0NE8XYXysP+DGNKHfuwv Y7kxvUdBeoGlODJ6+SfaPg== STRIBOG256: P1OaIT6XyALMIp1HTGqjKoJaNgsqkzqU n9klII2c4bs= STRIBOG512: jpRdogmqhp8EVZKFKbyuRnnphzq3B7VT FfVs65i+8Kc2L3FVKDVu6DzaXyqsTGrS ujpxXBvNgcuOn5C/TBwaig== SHA512/256: xnK40e9W7Sirh8NiLFEUBpvdOte4+XN0 mNDAHs7wlno= SHA3-256 : p//G+L8e12ZRwUdWoGHWYvWA/03kO0n6 gtgKS4D4Q0o= SHA3-512 : pp9zzKI6msXItWfcGFp1bpfJghZP4lhZ 4NHcwUdcgKYVshI68fX5TBHj6UAsOsVY 9QAZnZW20+MBdYWGKB3NJg== End timestamp: 2026-10-17 19:30:35 +0200 (run time: 0m 0s) The report correctly shows the addition of `regular_file.txt` but misses the addition of the malicious file. The malicious file is also not added to the AIDE database. Analysis ======== The vulnerability is caused by improper handling of UTF-8 validation errors returned from `pcre2_match` function, resulting in malicious file names never matching any regular expression rule. This allows a user to craft a file name including invalid UTF-8 byte sequences to effectively hide the file from AIDE detection. Mitigation ========== Upgrade to AIDE v0.19.5 Alternatively apply the provided patch: aide-0.19_GHSA-wq25-fm54-5q3q_invalid-utf-8.patch Credit ====== The issue was reported by Rajesh Pangare. References ========== [AIDE](https://aide.github.io) [v0.19.5](https://github.com/aide/aide/releases/tag/v0.19.5) [GHSA-wq25-fm54-5q3q](https://github.com/aide/aide/security/advisories/GHSA-wq25-fm54-5q3q) -------------- next part -------------- A non-text attachment was scrubbed... Name: aide-0.19_GHSA-wq25-fm54-5q3q_invalid-utf-8.patch Type: text/x-diff Size: 3431 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 659 bytes Desc: not available URL: From hannes at vonhaugwitz.com Thu Oct 22 17:12:59 2026 From: hannes at vonhaugwitz.com (Hannes von Haugwitz) Date: Thu, 22 Oct 2026 16:12:59 +0200 Subject: [Aide] aide (<= 0.19.4) improper comparison of hash values containing a null byte (AIDE detection bypass) [GHSA-6wc9-4w69-5jc5, CVE pending] Message-ID: <20261022141259.GA2@magnesium.vonhaugwitz.com> Summary ======= It was discovered that AIDE, a host-based file and directory integrity checker, improperly compares hash values containing a null byte. An attacker could craft a malicious file with a hash value matching the existing hash in every byte up to and including the first 0x00 byte so that the hash change is silently ignored by AIDE. A local user could exploit this to bypass the AIDE detection of malicious files. Project ======= AIDE (Advanced Intrusion Detection Environment) Affected versions ================= AIDE <= 0.19.4 CVE ID ====== A CVE ID has been requested, but is not yet available; please cross-reference this vulnerability as GHSA-6wc9-4w69-5jc5 for now. The advisory will be updated, as soon as a CVE ID is available. Proof of concept ================ $ mkdir test $ echo -n "00031388$(for i in {1..248} ; do printf '%c' x ; done)" > test/file $ aide --config <(printf -- "root_prefix=./test\n\ndatabase_out=stdout\n/file sha256+sha512\n") --init > test/aide.db $ echo -n "!0031388$(for i in {1..248} ; do printf '%c' x ; done)" > test/file $ aide --config <(printf -- "root_prefix=./test\n\ndatabase_in=file:test/aide.db\n/file sha256+sha512\n") --check Start timestamp: 2026-10-17 19:28:38 +0200 (AIDE 0.19.4) AIDE found differences between database and filesystem!! Root prefix: ./test Summary: Total number of entries: 1 Added entries: 0 Removed entries: 0 Changed entries: 1 --------------------------------------------------- Changed entries: --------------------------------------------------- f H : /file --------------------------------------------------- Detailed information about changes: --------------------------------------------------- File: /file SHA512 : P8b+dtBxYkuzpArlOTav0mcbnsgyK6yN | M4dh5Bf8Qq8SXttTI05UFhooBkU6TzBg GXLU29ddIz0KH8JwXFQBg1kr29WRxCf1 | IdvZInsXpytohLbiVQws60Qa+rNOn1yz CEh60upsX4R1fFjjVjZ4xA== | yVPaQ2MEcqsMQ/CZNKy7kg== --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- test/aide.db SHA256 : 7pkJPevLDacvy1SlNpDdbO2LJC9K+eVp JbiJwoPJz1c= SHA512 : cE7/5LIJ45y0JrY51BqX033/PaY50qHU 1UMUz7zQzILXJObOsG0C2SV2PVCQJWFx ocCjWdAy8ZOaDBX/aN9Xhw== STRIBOG256: cnuQwLejgI+VBBVvl3EcHPcU+eW855Gx BJNvvVIqOk4= STRIBOG512: CZa/yVLVDQQkCR+Z5Q+zO4u3nvGSRci+ IOvlfUkMZuDcBu9cTfGmiPZLbnzgpRsk 2Yz1t3TnRE1DhDH4Wzf/qg== SHA512/256: rk6L06UvIay94ky7CEtMdmCUTEVaBMtk zK/Ojy0AoEA= SHA3-256 : lU0ArehEa2V4Ovhujiz/GjsZLyNpjwhM LoLS+1HYlhY= SHA3-512 : nOFvtQgHYrlT+XMCc3BqflAd6iCdbbC5 1Zr4VerGXc+aOnD2E5Nrl6Z4U2Yed8RI 3PUOngDqiUafGusEM+yVcQ== End timestamp: 2026-10-17 19:28:38 +0200 (run time: 0m 0s) The report correctly shows the change of the `sha512` hash, but misses the change of the `sha256` hash. Analysis ======== The vulnerability is caused by using `strncmp` instead of `memcmp` for comparing hash values in `bytecmp` function, resulting in `bytecmp` not comparing the entire hash value if one of the hash values contain a null byte. In the proof of concept example above the hash values of the old and the new content starts with a null byte, so only the first byte (the 0x00 byte) is compared and the `sha256` hash value change is missed. Mitigation ========== Upgrade to AIDE v0.19.5 Alternatively apply the provided patch: aide-0.19_GHSA-6wc9-4w69-5jc5_bytecmp.patch If you cannot upgrade, consider adding multiple hash functions to your rules (the `H` attribute group adds all available hash functions) to increase the probability a content change is reported even if one hash contains a null byte. Credit ====== The issue was reported by a community member. References ========== [AIDE](https://aide.github.io) [v0.19.5](https://github.com/aide/aide/releases/tag/v0.19.5) [GHSA-6wc9-4w69-5jc5](https://github.com/aide/aide/security/advisories/GHSA-6wc9-4w69-5jc5) -------------- next part -------------- A non-text attachment was scrubbed... Name: aide-0.19_GHSA-6wc9-4w69-5jc5_bytecmp.patch Type: text/x-diff Size: 458 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 659 bytes Desc: not available URL: