CVE-2025-54989: 
NixOS vulnerability analysis and mitigation

CVE-2025-54989 is a NULL pointer dereference denial-of-service vulnerability in the Firebird relational database, specifically within the XDR (External Data Representation) message parsing logic for client communications. The vulnerability was reported on May 5, 2025, and publicly disclosed on August 15, 2025, after patches were prepared for all affected branches. It affects all Firebird versions prior to 3.0.13, 4.0.6, and 5.0.3. The CVSS v3.1 base score is 7.5 (High) per NVD, while the GitHub Security Advisory rates it 5.3 (Moderate) (GitHub Advisory, Red Hat).

The root cause is a NULL pointer dereference (CWE-476) in the xdr_trrq_message function within src/remote/protocol.cpp. When parsing an XDR message from a client, the function accesses the port_rpr (procedure) pointer without first verifying it is non-NULL; if the pointer is NULL, the server crashes. The fix adds an explicit NULL check (fb_assert(procedure); if (!procedure) return false;) before the pointer is dereferenced (GitHub Commit). The vulnerability is network-reachable, requires no authentication, and no user interaction, making it trivially exploitable by any client that can reach the Firebird service port (default TCP 3050) (GitHub Advisory). The issue was originally tracked as ZDI-CAN-26486 and reported through the Zero Day Initiative (ZDI Advisory).

Successful exploitation causes the Firebird database server process to crash due to a NULL pointer dereference, resulting in a complete loss of availability for all databases hosted on that instance. There is no impact on confidentiality or data integrity — attackers cannot read or modify data through this vulnerability. Any application or service dependent on the affected Firebird instance will experience service interruption until the server is restarted (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.049%, indicating a low probability of exploitation in the near term. However, the lack of authentication requirement and network accessibility lower the barrier for any attacker who can reach the Firebird service port.

1. Reconnaissance: Identify internet-facing or network-accessible Firebird database servers using tools like Shodan or Nmap, targeting the default Firebird port TCP 3050, and confirm the server version is below 3.0.13, 4.0.6, or 5.0.3.
2. Craft malicious XDR message: Construct a specially crafted XDR protocol message that triggers the xdr_trrq_message code path in protocol.cpp while the port_rpr (procedure) pointer is NULL — for example, by sending a transaction request message in an unexpected protocol state.
3. Send the payload: Transmit the crafted XDR message to the Firebird server over TCP port 3050 without any authentication credentials.
4. Trigger crash: The server's xdr_trrq_message function dereferences the NULL procedure pointer, causing an immediate process crash and denial of service for all connected clients and dependent applications (GitHub Commit, GitHub Advisory).

• Network: Unexpected or repeated TCP connection attempts to Firebird port 3050 from unknown or external IP addresses; malformed or anomalous XDR protocol messages in network captures.
• Logs: Firebird server logs showing sudden process termination or crash entries (e.g., SIGABRT, SIGSEGV, or assertion failure messages) correlated with incoming client connections; repeated server restart events in system logs.
• Process: Unexpected termination of the fbserver or fb_inet_server process; watchdog or service manager logs showing automatic restarts of the Firebird service.

Upgrade Firebird to the patched versions: 3.0.13, 4.0.6, or 5.0.3 (or later), which include the NULL pointer check fix in protocol.cpp (GitHub Advisory, GitHub Commit). Note that Firebird 2.5.9 also received a backported fix (FirebirdNews). As interim mitigations, restrict network access to the Firebird service port (TCP 3050) using firewalls or network segmentation, allowing only trusted IP addresses to connect. Debian LTS and stable packages have also been updated via security advisories (DLA-4282-1 and DSA-5992-1).

Heise Online covered the vulnerability as part of broader Firebird database security issues, noting both DoS vulnerabilities and potential unauthorized access concerns (Heise). The Zero Day Initiative published an advisory (ZDI-25-859) acknowledging the original report (ZDI Advisory). Debian, Fedora, and SUSE Linux distributions issued security updates incorporating the fix, reflecting broad downstream adoption of the patch. Community reaction has been measured, consistent with the moderate severity and DoS-only impact of the vulnerability.