PT-2024-10125 · Rsync+10 · Rsync+10
Jspelman-Google
+2
·
Published
2024-11-14
·
Updated
2025-11-20
·
CVE-2024-12085
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
The rsync daemon is affected by a flaw that can be triggered when comparing file checksums, allowing an attacker to manipulate the checksum length and cause a comparison between a checksum and uninitialized memory. This results in the leak of one byte of uninitialized stack data at a time.
An exploit for this issue could potentially allow an attacker to leak sensitive data from the stack.
The affected software is the rsync daemon.
The flaw is related to a buffer overflow in memory due to incorrect comparison of file checksums, which can be exploited by a remote attacker to bypass the ASLR protection mechanism and gain unauthorized access to protected information.
More information about the issue can be found at https://access.redhat.com/security/cve/cve-2024-12085.
#rsync #rsyncdaemon #linux #security #exploit #ASLR #bufferoverflow #uninitializedstack #remotexploit
Exploit
Fix
Buffer Overflow
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Rsync