CVE-2025-65409
Divide-by-Zero in GNU Recutils Encryption Causes DoS
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gnu | recutils | 1.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a divide-by-zero error in the encryption and decryption routines of GNU Recutils version 1.9. It occurs when an attacker inputs an empty value as a password, which causes the software to attempt a division by zero, leading to a crash or denial of service.
How can this vulnerability impact me? :
The vulnerability can cause a Denial of Service (DoS) condition, meaning that the affected software can crash or become unavailable when an attacker inputs an empty password value, potentially disrupting normal operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the GNU Recutils utilities recfix or rec-crypt are used with an empty password, which triggers a divide-by-zero error causing a SIGFPE. To detect attempts to exploit this, monitor logs or run the utilities with empty passwords to see if they crash. There are no specific commands provided, but you can test by running: rec-crypt -p "" or recfix --password "" and observe if a floating-point exception occurs. Additionally, reviewing the source code or binaries for the presence of the vulnerable versions (e.g., version 1.9) can help identify if the system is affected. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating GNU Recutils to a version where the patch is applied that rejects empty passwords in recfix and rec-crypt utilities. If an update is not immediately possible, ensure that no empty passwords are used with these utilities by enforcing password validation. The patch adds explicit checks to abort operations if the password is empty, preventing the divide-by-zero error. Avoid using empty passwords and apply the patch or upgrade to a fixed version as soon as possible. [3]