CVE-2025-13654: 
NixOS vulnerability analysis and mitigation

CVE-2025-13654 is a stack-based buffer overflow vulnerability in the buffer_get function of Duc, an open-source disk management tool for Linux. The flaw exists in all versions prior to 1.4.6 and was publicly disclosed on December 5, 2025, following responsible disclosure to the vendor on November 3, 2025. It carries a CVSS v3.1 base score of 7.5 (High), reflecting its network-exploitable, unauthenticated nature with high availability impact (CERT/CC VU#441887, Feedly).

The root cause is an integer underflow (CWE-787: Out-of-bounds Write) in buffer.c's buffer_get function, where the length check was implemented as b->ptr <= b->len - len using unsigned arithmetic. When len exceeds b->len - b->ptr, the subtraction wraps around to a large positive value, causing the condition to evaluate as true and allowing memcpy() to read beyond the buffer's intended bounds. The fix in commit 8638c43 corrects the check to b->ptr + len <= b->len, eliminating the underflow condition. An attacker can trigger this by supplying crafted input to any database or input stream processed by Duc (CERT/CC VU#441887, GitHub Commit). A public proof-of-concept write-up is available from the original reporter (HackingByDoing PoC).

Successful exploitation can cause Duc to crash (denial of service) or disclose adjacent stack memory contents, potentially exposing sensitive data that should remain inaccessible. In enterprise environments where Duc is used for disk indexing pipelines, an attacker who can supply malformed input to the tool's database or input stream could disrupt disk management operations or leak internal memory data. The CVSS score reflects high availability impact with no confidentiality or integrity impact formally scored, though the CERT/CC advisory notes the potential for information leakage in practice (CERT/CC VU#441887, Feedly).

A proof-of-concept exploit write-up is publicly available from the researcher HackingByDoing, published around the time of disclosure (HackingByDoing PoC). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.042% (0.000420), indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Identify target: Locate systems running Duc versions prior to 1.4.6 on Linux, particularly those where Duc processes externally supplied or attacker-influenced input (e.g., network-accessible disk indexing services).
2. Craft malformed input: Prepare a malicious database entry or input stream where the encoded data length field causes len to exceed the remaining buffer space (b->len - b->ptr), triggering the unsigned integer underflow in buffer_get.
3. Supply input to Duc: Deliver the crafted input to the Duc database or input stream being processed — this could be via a shared filesystem, a network-accessible indexing service, or any other mechanism where Duc reads attacker-controlled data.
4. Trigger the overflow: When buffer_get evaluates the flawed condition b->ptr <= b->len - len, the underflow causes the check to pass, and memcpy() reads beyond the buffer boundary.
5. Achieve objective: Depending on memory layout, the result is either a crash (DoS) or out-of-bounds stack memory disclosure, potentially leaking sensitive runtime data (CERT/CC VU#441887, HackingByDoing PoC).

• Logs: Unexpected crashes or segmentation faults in Duc process logs; error messages referencing buffer_get or buffer.c in application output.
• Process: Duc process terminating abnormally or producing core dumps; unusual memory access violations reported by the OS.
• File System: Presence of core dump files (core, duc.core) in the working directory or /var/crash/ following unexpected Duc termination.
• Network: If Duc is exposed via a network-accessible service, anomalous or malformed requests to the indexing endpoint with oversized or malformed length fields in the data stream.

The primary remediation is to upgrade Duc to version 1.4.6 or later, which fixes the logic error in buffer_get (commit 8638c43) (GitHub Release). All versions prior to 1.4.6 are considered affected. As a temporary workaround where immediate patching is not possible, restrict access to Duc's input sources through network segmentation and ensure only trusted, validated data is processed by the tool. Monitor for anomalous crashes or unexpected process terminations as a detection measure (CERT/CC VU#441887).

The vulnerability was reported by researcher HackingByDoing and coordinated through CERT/CC (VU#441887), which published an advisory on December 5, 2025. The issue received coverage in security news outlets including SecurityOnline.info and was mentioned in The Hacker News weekly recap. Red Hat has tracked the CVE in their security advisory system. Linux distribution maintainers for SUSE and Fedora have issued package updates addressing the vulnerability (CERT/CC VU#441887, SecurityOnline).