Full Report
Security researchers report that Microsoft considers the side-channel leak of file events to be by design
Analysis Summary
# Vulnerability: Multi-OS File Notification Side-Channel Leakage
## CVE Details
- **CVE ID:** CVE-2025-68788 (Specific to Linux kernel); No CVEs assigned for Windows, macOS, or Android as of the report.
- **CVSS Score:** Not explicitly rated in the article (Estimated Medium severity due to side-channel nature).
- **CWE:** CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
## Affected Systems
- **Products:**
- **Linux:** Kernels using `inotify` (since 2005).
- **Android:** Devices using `FileObserver` (since 2008).
- **Windows:** Systems using `ReadDirectoryChangesW` (since 2000).
- **macOS:** Systems using `FSEvents` (since 2007).
- **Versions:**
- **Linux:** Versions prior to December 2025 patches (5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3).
- **Windows:** All versions (Microsoft considers the behavior "by design").
- **Android:** Most versions; no mitigation reported for the FUSE layer bypass.
- **Configurations:** Systems where unprivileged users can access file notification subsystems to monitor global or system directories.
## Vulnerability Description
The vulnerability stems from flaws in how modern operating systems implement file notification subsystems. These systems (e.g., `inotify`, `ReadDirectoryChangesW`) are designed to alert applications when files are modified, opened, or deleted.
The security flaw exists because these notifications act as a side channel. Even if a user cannot read the *content* of a file, the notification subsystem may leak the *existence* and *timing* of file access. On Windows, monitoring the root `C:\` drive reports the full path of every file touched across all users. On Linux, monitoring `/dev/input` leaks keystroke timings. On Android, the system bypasses the FUSE isolation layer, allowing permissionless apps to monitor private app folders (e.g., WhatsApp).
## Exploitation
- **Status:** PoC available (demonstrated by researchers at TU Graz).
- **Complexity:** Medium (Requires "templating" to translate file events into actionable data).
- **Attack Vector:** Local (though remote exploitation via SSH inter-keystroke timing was demonstrated).
## Impact
- **Confidentiality:** High (Leaks keystrokes, website browsing history via fingerprinting, and application activity).
- **Integrity:** Low (Can be used for UI redress/clickjacking attacks to steal credentials).
- **Availability:** None.
## Remediation
### Patches
- **Linux:** Apply kernel updates: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3. These patches specifically prevent "access" and "modify" events on special files in `/dev/`.
- **Windows/Android/macOS:** No official patches available at the time of the report.
### Workarounds
- **General:** Restrict unprivileged access to sensitive system directories where possible.
- **Windows:** The researchers propose manually disallowing the monitoring of entire drives, though this may break legitimate software.
- **Linux:** Ensure the kernel is updated to the versions listed above to mitigate keystroke logging via `/dev/input`.
## Detection
- **Indicators of Compromise:** Unusual or persistent calls to file system monitoring APIs (`inotify_add_watch` on Linux, `ReadDirectoryChangesW` on Windows) by unprivileged or suspicious processes.
- **Detection methods:** Monitor for processes attempting to set watches on sensitive paths like `/dev/`, `C:\`, or other users' private directories.
## References
- **NVD Entry:** [https://nvd.nist.gov/vuln/detail/cve-2025-68788]
- **Researcher Summary:** [https://inoti[.]fyi/]
- **Linux Man Pages:** [https://man7[.]org/linux/man-pages/man7/inotify.7.html]
- **Microsoft Documentation:** [https://learn[.]microsoft[.]com/en-us/windows/win32/api/winbase/nf-winbase-readdirectorychangesw]