AIDE: Integrity check bypass via invalid UTF-8 filenames

AIDE (Advanced Intrusion Detection Environment) contains a vulnerability where filenames containing invalid UTF-8 byte sequences are silently ignored during integrity checks. This vulnerability affects versions 0.16 through 0.19.4. A local attacker can leverage this behavior to conceal files or directories from AIDE, effectively bypassing the system integrity monitor.

Impact

An attacker with local file system access can create directories or files using invalid UTF-8 encoding to prevent detection by AIDE. This allows the concealment of unauthorized scripts, payloads, or modified system files, undermining the integrity of the host monitoring solution.

Recommendation

• Upgrade to a version of AIDE that includes a fix for invalid UTF-8 filename handling once released by the maintainers.
• Audit existing AIDE databases for files that may be intentionally hidden using non-UTF-8 characters in filenames.
• Monitor local filesystem events for the creation of files with non-standard or invalid encoding patterns in sensitive directories.