PT-2024-10127 · Rsync+6 · Rsync+6
Jspelman-Google
+2
·
Published
2024-10-30
·
Updated
2026-02-22
·
CVE-2024-12084
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
rsync versions prior to 3.4.0
Description
Rsync contains multiple vulnerabilities, including a critical heap-buffer overflow that allows for remote code execution. The heap-based buffer overflow occurs due to improper handling of attacker-controlled checksum lengths (
s2length) in the code. Specifically, when MAX DIGEST LEN exceeds the fixed SUM LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. Approximately 600,000 systems are potentially affected globally. The vulnerability allows an attacker with anonymous read access to a rsync server to execute arbitrary code on the server. The rsync daemon is affected.Recommendations
Upgrade to rsync version 3.4.0 or later.
Exploit
Fix
DoS
RCE
Buffer Overflow
Heap Based Buffer Overflow
Memory Corruption
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Rsync