CVE-2025-65409: 
NixOS vulnerability analysis and mitigation

CVE-2025-65409 is a divide-by-zero vulnerability (CWE-369) in the encryption/decryption routines of GNU Recutils v1.9 that allows attackers to cause a Denial of Service (DoS) by supplying an empty string as a password. The flaw exists in src/rec-crypt.c within the rec_encrypt and rec_decrypt functions, and is also reachable via the recfix command-line utility. It was reported to the GNU bug-recutils mailing list on 2025-10-30 and the CVE was published on 2025-12-30. The CVSS v3.1 base score is 7.5 (High), assigned by CISA-ADP (Vulnerability Disclosure, GNU Mailing List).

The root cause is a missing validation of password length before performing a modulo operation in the key derivation logic of src/rec-crypt.c (CWE-369). When a user supplies an empty password (""), strlen(password) returns 0, and the expression i % password_size triggers a divide-by-zero, causing the process to receive a SIGFPE signal and crash. The vulnerable code path is: password_size = strlen(password); key[i] = password[i % password_size]; — with no guard against password_size == 0. The attack is local in nature, requiring an attacker to invoke recfix (or a wrapper calling the affected library functions) with an empty --password argument; no authentication or elevated privileges are required beyond the ability to run the utility (Vulnerability Disclosure).

Successful exploitation results in a process crash (SIGFPE / core dump) of the affected recfix process or any application invoking rec_encrypt/rec_decrypt with an empty password, causing a local Denial of Service. There is no confidentiality or integrity impact — the bug does not expose data or corrupt records. The availability impact is limited to the affected process and does not affect the broader system or enable lateral movement (Vulnerability Disclosure).

A public proof-of-concept is available in the researcher's GitHub disclosure repository, demonstrating that running ./recfix --decrypt -s '' poc_cwe369.rec or ./recfix --encrypt -s '' test.rec consistently triggers the crash on GNU Recutils 1.9. The EPSS score is approximately 0.014% (0.000140), indicating very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Vulnerability Disclosure).

1. Identify target: Confirm the target system is running GNU Recutils v1.9 with crypt support enabled (check binary version or package metadata).
2. Invoke vulnerable utility: Execute recfix with the --decrypt or --encrypt flag and supply an empty string as the password argument: ./recfix --decrypt -s '' target.rec
3. Trigger divide-by-zero: The empty password causes strlen(password) to return 0; the key derivation loop in rec-crypt.c performs i % 0, triggering SIGFPE.
4. Observe crash: The recfix process terminates with "Floating point exception (core dumped)", achieving a local Denial of Service against the process (Vulnerability Disclosure).

• Process: Unexpected termination of recfix with exit signal SIGFPE (signal 8); presence of core dump files (e.g., core, core.<pid>) in the working directory of the recfix process.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing entries like recfix[<pid>]: signal 8 (Floating point exception) or kernel messages about abnormal process termination.
• File System: Core dump files generated in the directory where recfix was invoked, potentially containing memory snapshots of the crashed process.

The upstream GNU Recutils maintainer (Jose E. Marchesi) reviewed the report and applied patches to the main branch on 2025-10-30, implementing two complementary fixes: (1) CLI-layer rejection of empty --password values in utils/recfix.c (if (optarg == NULL || optarg[0] == '\0') recutl_fatal(...)), and (2) a guard in src/rec-crypt.c that returns false before the modulo operation if password_size <= 0. Users should upgrade to a GNU Recutils version that includes these patches. As an interim workaround, enforce non-empty password policies in any wrapper scripts or tooling that invoke recfix or the affected library functions (Vulnerability Disclosure, GNU Mailing List).

The vulnerability received limited industry attention commensurate with its local, low-severity nature. Red Hat filed a Bugzilla tracking entry (Red Hat Bugzilla), and SUSE issued package updates for libmatio, dirmngr, and GNU Recutils that included the fix. A Tenable Nessus plugin (ID 280737) was published to detect the vulnerable version. Social media activity was minimal, with only a brief mention on Bluesky.