PT-2026-61730 · Rsyncproject · Rsync
CVE-2026-44510
·
Publicado
2026-07-20
·
Atualizado
2026-07-20
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recv files() lets a malicious rsync server (or any peer acting in the sender role) deterministically crash any rsync client that pulls from it. The trigger is fully wire-protocol-level, requires no special options on the victim, and works for both rsync:// URLs and remote-shell pulls; since inc recurse is the protocol-30+ default, any client doing a normal recursive pull against an attacker-controlled URL is exposed. A malicious server sets CF INC RECURSE, sends a flist whose first sorted entry is not the leading "." directory (causing parent ndx to be set to -1), then sends a transfer record with ndx = 0 and an iflag omitting ITEM TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference the result in f name(). The impact is crash-only: the out-of-bounds read lands in glibc mmap chunk metadata and dereferences to an unmapped low address, producing a SEGV that cannot be leveraged into an exploit (confirmed on glibc x86-64 Linux; non-glibc allocators not audited). This issue is fixed in version 3.4.3.
Correção
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Rsync