FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

aide -- heap-based buffer overflow

Affected packages
		aide	<	0.17.4

Details

VuXML ID	309c35f4-7c9f-11ec-a739-206a8a720317
Discovery	2022-01-15
Entry	2022-01-23

David Bouman reports:

AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow.

Aide uses a fixed size (16k bytes) for the return buffer in encode_base64/decode_base64 functions. This results in a segfault if aide processes a file with too large extended attribute value or ACL.

[source]

References

CVE Name	CVE-2021-45417
URL	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45417