Skip to content
OpenAdvisories
Low ALAS2-2026-3186 1 CVE

Low: aide security update (Amazon Linux 2)

Published Mar 2, 2026 · Updated Mar 5, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-54409: AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 aide 0:0.16.2-1.amzn2.0.3
Amazon Linux · 2 aide-debuginfo 0:0.16.2-1.amzn2.0.3

Vulnerabilities 1

  • Medium 6.2
    CVE-2025-54409

    AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)

    AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes w…

    aide aide aide aide Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-54409.html