Listen to this Post
The vulnerability exists within the `fim_alert()` function of the Wazuh manager’s analysisd process. This function processes File Integrity Monitoring (FIM) alerts sent by agents. When generating a diff alert for a modified file, the function retrieves checksum data from an `oldsum` structure to include the previous file’s MD5 hash in the alert log.
The code path does not validate if the `oldsum` pointer or the `oldsum->md5` field is NULL before dereferencing it to access the MD5 string. A compromised or malicious agent can send a specially crafted FIM event message where the `oldsum` structure is present but the `md5` field within it is set to NULL. When the manager’s analysisd service receives this message and processes it through the vulnerable `fim_alert()` code, it attempts to read from the NULL `md5` pointer.
This illegal memory access causes a segmentation fault in the critical analysisd daemon, leading to a denial-of-service condition. The manager’s capability to analyze and correlate incoming events is halted until the service is manually restarted. The attack requires a compromised agent, granting the attacker the necessary privileges to send crafted data to the manager.
Platform: Wazuh Manager
Version: 3.7.0 – 4.11.x
Vulnerability: NULL Pointer Dereference
Severity: Medium
Date: 2025-11-21
Prediction: 2025-11-21
What Undercode Say:
Check current Wazuh manager version /var/ossec/bin/wazuh-control info | grep version
// Vulnerable code snippet (simplified) in fim_alert(): // oldsum->md5 is dereferenced without a NULL check. char old_md5 = oldsum->md5; // Potential crash here snprintf(alert_diff, sizeof(alert_diff), "Old MD5: %s", old_md5);
Example command to restart the crashed analysisd service systemctl restart wazuh-manager
How Exploit:
Agent sends crafted FIM event with oldsum->md5 = NULL.
Protection from this CVE:
Upgrade to version 4.12.0.
Impact:
Denial-of-Service (analysisd crash).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
