CVE-2025-64429
📋 TL;DR
DuckDB's block-based encryption implementation contains multiple cryptographic flaws that could allow attackers to bypass encryption, compromise keys, or downgrade security. Users of DuckDB 1.4.0 through 1.4.1 who enable database encryption are affected. The vulnerabilities stem from insecure random number generation, improper memory clearing, and missing integrity checks.
💻 Affected Systems
- DuckDB
📦 What is this software?
Duckdb by Duckdb
⚠️ Risk & Real-World Impact
Worst Case
Complete database decryption and data exposure, integrity bypass allowing undetected data manipulation, and cryptographic key compromise leading to persistent access.
Likely Case
Partial data exposure through temporary file encryption bypass or integrity check circumvention, potentially allowing data tampering without detection.
If Mitigated
Limited impact if databases use strong external encryption or if DuckDB is deployed without encryption features enabled.
🎯 Exploit Status
Exploitation requires access to database files or process memory. Multiple attack vectors exist including header manipulation, memory analysis, and RNG state compromise.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.2
Vendor Advisory: https://github.com/duckdb/duckdb/security/advisories/GHSA-vmp8-hg63-v2hp
Restart Required: Yes
Instructions:
1. Download DuckDB 1.4.2 or later from official sources. 2. Replace existing DuckDB binaries. 3. Recreate encrypted databases with new version. 4. Verify encryption settings on existing databases.
🔧 Temporary Workarounds
Disable block-based encryption
allUse DuckDB without the vulnerable encryption feature
Do not use 'PRAGMA encryption_key' or encryption-related commands
Create databases without encryption enabled
Use external encryption
allEncrypt database files at filesystem level instead of using DuckDB's built-in encryption
Use LUKS, BitLocker, or similar filesystem encryption
Mount encrypted volumes before running DuckDB
🧯 If You Can't Patch
- Disable all encryption features and rely on external storage encryption
- Restrict file system access to DuckDB database files and monitor for unauthorized modifications
🔍 How to Verify
Check if Vulnerable:
Check DuckDB version and encryption status: Run DuckDB and execute '.version' command, then check if databases use encryption with 'PRAGMA encryption_status'Check Version:
duckdb --version or from within DuckDB: .versionVerify Fix Applied:
Verify version is 1.4.2 or later and test encryption functionality with known test vectors📡 Detection & Monitoring
Log Indicators:
- Failed encryption operations
- Unexpected database header modifications
- Memory access patterns suggesting key extraction attempts
Network Indicators:
- Not applicable - local file system vulnerability
SIEM Query:
Process execution of duckdb with version <1.4.2 AND file access patterns to *.db files with encryption headers