Vulnerabilities

CVE-2024-12084 is a critical (CVSS 9.8) heap-based buffer overflow in the rsync daemon, caused by improper handling of an attacker-controlled checksum length (s2length): when MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH of 16 bytes, a connecting peer can cause an out-of-bounds write into the fixed-size sum2 buffer. A remote attacker who can reach the rsync daemon needs no privileges or user interaction to trigger the flaw, and the resulting heap corruption can lead to remote code execution on the server (as demonstrated in the referenced Google security research) or crash the daemon. Any system running a vulnerable rsync daemon is affected — including rsync shipped with Red Hat Enterprise Linux, SUSE Linux, AlmaLinux, Arch Linux, Gentoo, NixOS and SmartOS — with the highest risk on servers where the daemon is exposed on TCP port 873. No confirmed in-the-wild exploitation is documented yet (the CVE is not on CISA KEV), but a public proof-of-concept exists from Google Cloud researchers and EPSS assigns a 72.1% probability of exploitation within 30 days, indicating high imminent risk.

Do: Upgrade rsync to 3.4.1 or later, or install the patched rsync package from your distribution (Red Hat, SUSE, AlmaLinux, Arch, Gentoo, NixOS and SmartOS have all shipped fixes). Until patched, restrict TCP port 873 to trusted networks or disable the rsync daemon where it is not needed. Audit hosts for listening rsync daemons and verify the installed rsync version against your vendor's advisory.

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.