CVE-2025-13654
📋 TL;DR
A stack buffer overflow vulnerability in duc's buffer_get function allows out-of-bounds memory reads due to an underflow condition. This could potentially lead to arbitrary code execution or denial of service. Users of the duc disk management tool are affected.
💻 Affected Systems
- duc (disk usage analyzer)
📦 What is this software?
Duc by Zevv
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if duc processes untrusted input from network sources.
Likely Case
Local privilege escalation or denial of service when processing malicious disk analysis data.
If Mitigated
Limited impact if duc only processes trusted local files with standard user privileges.
🎯 Exploit Status
Exploit requires local access or ability to feed malicious input to duc process.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.6
Vendor Advisory: https://github.com/zevv/duc/releases/tag/1.4.6
Restart Required: No
Instructions:
1. Download duc 1.4.6 from GitHub releases. 2. Compile and install following project documentation. 3. Replace existing duc binary with patched version.
🔧 Temporary Workarounds
Restrict duc execution
linuxLimit duc to trusted users and prevent processing of untrusted input files
chmod 750 /usr/local/bin/duc
setfacl -m u:trusteduser:rx /usr/local/bin/duc
🧯 If You Can't Patch
- Remove setuid/setgid bits from duc binary if present
- Run duc with reduced privileges using sudo restrictions or containers
🔍 How to Verify
Check if Vulnerable:
Check duc version: duc --version | grep -q '1\.4\.[0-5]\|1\.[0-3]\..*' && echo 'VULNERABLE'Check Version:
duc --versionVerify Fix Applied:
Verify version is 1.4.6 or later: duc --version | grep -q '1\.4\.6\|1\.[5-9]\..*' && echo 'PATCHED'📡 Detection & Monitoring
Log Indicators:
- Segmentation fault crashes of duc process
- Abnormal memory access patterns in system logs
Network Indicators:
- None - local tool only
SIEM Query:
process.name:"duc" AND (event.action:"segmentation_fault" OR event.outcome:"failure")