CVE-2024-12084

CVE-2024-12084 is a critical (CVSS 9.8) heap-based buffer overflow in the rsync daemon, caused by improper handling of an attacker-controlled checksum length (s2length): when MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH of 16 bytes, a connecting peer can cause an out-of-bounds write into the fixed-size sum2 buffer. A remote attacker who can reach the rsync daemon needs no privileges or user interaction to trigger the flaw, and the resulting heap corruption can lead to remote code execution on the server (as demonstrated in the referenced Google security research) or crash the daemon. Any system running a vulnerable rsync daemon is affected — including rsync shipped with Red Hat Enterprise Linux, SUSE Linux, AlmaLinux, Arch Linux, Gentoo, NixOS and SmartOS — with the highest risk on servers where the daemon is exposed on TCP port 873. No confirmed in-the-wild exploitation is documented yet (the CVE is not on CISA KEV), but a public proof-of-concept exists from Google Cloud researchers and EPSS assigns a 72.1% probability of exploitation within 30 days, indicating high imminent risk.

What to do: Upgrade rsync to 3.4.1 or later, or install the patched rsync package from your distribution (Red Hat, SUSE, AlmaLinux, Arch, Gentoo, NixOS and SmartOS have all shipped fixes). Until patched, restrict TCP port 873 to trusted networks or disable the rsync daemon where it is not needed. Audit hosts for listening rsync daemons and verify the installed rsync version against your vendor's advisory.