Rsync vulnerabilities allow remote code execution on servers, patch quickly!
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-12084 | Heap-Based Buffer Overflow in rsync Daemon Enables Potential Remote Code Execution CVE-2024-12084 is a critical (CVSS 9.8) heap-based buffer overflow in the rsync daemon, caused by improper handling of an attacker-controlled checksum length (s2length): when MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH of 16 bytes, a connecting peer can cause an out-of-bounds write into the fixed-size sum2 buffer. A remote attacker who can reach the rsync daemon needs no privileges or user interaction to trigger the flaw, and the resulting heap corruption can lead to remote code execution on the server (as demonstrated in the referenced Google security research) or crash the daemon. Any system running a vulnerable rsync daemon is affected — including rsync shipped with Red Hat Enterprise Linux, SUSE Linux, AlmaLinux, Arch Linux, Gentoo, NixOS and SmartOS — with the highest risk on servers where the daemon is exposed on TCP port 873. No confirmed in-the-wild exploitation is documented yet (the CVE is not on CISA KEV), but a public proof-of-concept exists from Google Cloud researchers and EPSS assigns a 72.1% probability of exploitation within 30 days, indicating high imminent risk. Do: Upgrade rsync to 3.4.1 or later, or install the patched rsync package from your distribution (Red Hat, SUSE, AlmaLinux, Arch, Gentoo, NixOS and SmartOS have all shipped fixes). Until patched, restrict TCP port 873 to trusted networks or disable the rsync daemon where it is not needed. Audit hosts for listening rsync daemons and verify the installed rsync version against your vendor's advisory. | 9.8 | 72% | PoC |
| massmillions of servers ship rsync across the affected distributions, with roughly 30,000–60,000 rsync daemons directly exposed on the public internet | |
| CVE-2024-12085 | A flaw was found in rsync which could be triggered when rsync compares file checksums. A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. NVD description · AI analysis pending | 7.5 group max | 9% | PoC |
| — | |
| CVE-2024-12747 | A flaw was found in rsync. A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation. NVD description · AI analysis pending | 5.6 | <1% | — | — |
Full article440 words · extracted from helpnetsecurity.com · click to collapse
Six vulnerabilities have been fixed in the newest versions of Rsync (v3.4.0), two of which could be exploited by a malicious client to achieve arbitrary code execution on a machine with a running Rsync server.
“The client requires only anonymous read-access to the server, such as public mirrors. Additionally, attackers can take control of a malicious server and read/write arbitrary files of any connected client. Sensitive data, such as SSH keys, can be extracted, and malicious code can be executed by overwriting files such as ~/.bashrc or ~/.popt,” CERT/CC noted.
About Rsync and the fixed vulnerabilities
Rsync is an open source utility used for synchronizing / transferring files and directories between different systems (computers, servers, storage devices, etc.), and is included by default in base installations of some Linux distributions.
“Rsync can also be used in Daemon mode and is widely used in in public mirrors to synchronize and distribute files efficiently across multiple servers,” CERT/CC added. “Many backup programs, such as Rclone, DeltaCopy, and ChronoSync use Rsync as backend software for file synchronization.”
The fixed vulnerabilities include:
- CVE-2024-12084, CVE-2024-12085 and CVE-2024-12086 are flaws in the Rsync daemon that could be exploited for remote code execution, leaking of stack data, and to read arbitrary files from the client’s machine (when they are being copied from a client to a server)
- CVE-2024-12087 and CVE-2024-12088 affect the Rsync client and may allow a malicious server to write malicious files to arbitrary locations on connected clients
- CVE-2024-12747 stems from Rsync improperly handling symbolic links during a race condition and can be used to leak sensitive information to the attacker
They all affect Rsync versions prior to v3.4.0, and CVE-2024-12084 is also present in v3.2.7 and higher. Mitigations for some the first two vulnerabilities are available (see here).
The first five flaws have been reported by Simon Scannell, Pedro Gallegos, and Jasiel Spelman at Google Cloud Vulnerability Research, and the last one by Aleksei Gorban.
What to do?
The Rsync maintainer has released a version with the fixes on Tuesday and users should implement them as soon as possible.
“As Rsync can be distributed bundled, ensure any software that provides such updates is also kept current to address these vulnerabilities,” CERT/CC says.
Updated Rsync packages have already been pushed out for Ubuntu and Debian.
CERT/CC’s list of affected OSes currently includes AlmaLinux OS, Arch Linux, Gentoo Linux, NixOS, Red Hat and SmartOS (i.e., the Triton DataCenter cloud management platform). The list will be updated as more information becomes available.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/01/15/rsync-vulnerabilities-allow-remote-code-execution-on-servers-patch-quickly/