Google Cloud Researchers Uncover Flaws in Rsync File Synchronization Tool
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-12084 | Heap-Based Buffer Overflow in rsync Daemon Enables Potential Remote Code Execution CVE-2024-12084 is a critical (CVSS 9.8) heap-based buffer overflow in the rsync daemon, caused by improper handling of an attacker-controlled checksum length (s2length): when MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH of 16 bytes, a connecting peer can cause an out-of-bounds write into the fixed-size sum2 buffer. A remote attacker who can reach the rsync daemon needs no privileges or user interaction to trigger the flaw, and the resulting heap corruption can lead to remote code execution on the server (as demonstrated in the referenced Google security research) or crash the daemon. Any system running a vulnerable rsync daemon is affected — including rsync shipped with Red Hat Enterprise Linux, SUSE Linux, AlmaLinux, Arch Linux, Gentoo, NixOS and SmartOS — with the highest risk on servers where the daemon is exposed on TCP port 873. No confirmed in-the-wild exploitation is documented yet (the CVE is not on CISA KEV), but a public proof-of-concept exists from Google Cloud researchers and EPSS assigns a 72.1% probability of exploitation within 30 days, indicating high imminent risk. Do: Upgrade rsync to 3.4.1 or later, or install the patched rsync package from your distribution (Red Hat, SUSE, AlmaLinux, Arch, Gentoo, NixOS and SmartOS have all shipped fixes). Until patched, restrict TCP port 873 to trusted networks or disable the rsync daemon where it is not needed. Audit hosts for listening rsync daemons and verify the installed rsync version against your vendor's advisory. | 9.8 | 72% | PoC |
| massmillions of servers ship rsync across the affected distributions, with roughly 30,000–60,000 rsync daemons directly exposed on the public internet | |
| CVE-2024-12085 | A flaw was found in rsync which could be triggered when rsync compares file checksums. A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. NVD description · AI analysis pending | 7.5 group max | 9% | PoC |
| — | |
| CVE-2024-12747 | A flaw was found in rsync. A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation. NVD description · AI analysis pending | 5.6 | <1% | — | — |
Full article359 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 15, 2025Vulnerability / Software Update
As many as six security vulnerabilities have been disclosed in the popular Rsync file-synchronizing tool for Unix systems, some of which could be exploited to execute arbitrary code on a client.
"Attackers can take control of a malicious server and read/write arbitrary files of any connected client," the CERT Coordination Center (CERT/CC) said in an advisory. "Sensitive data, such as SSH keys, can be extracted, and malicious code can be executed by overwriting files such as ~/.bashrc or ~/.popt."
The shortcomings, which comprise heap-buffer overflow, information disclosure, file leak, external directory file-write, and symbolic-link race condition, are listed below -
- CVE-2024-12084 (CVSS score: 9.8) - Heap-buffer overflow in Rsync due to improper checksum length handling
- CVE-2024-12085 (CVSS score: 7.5) - Information leak via uninitialized stack contents
- CVE-2024-12086 (CVSS score: 6.1) - Rsync server leaks arbitrary client files
- CVE-2024-12087 (CVSS score: 6.5) - Path traversal vulnerability in Rsync
- CVE-2024-12088 (CVSS score: 6.5) - --safe-links option bypass leads to path traversal
- CVE-2024-12747 (CVSS score: 5.6) - Race condition in Rsync when handling symbolic links
Simon Scannell, Pedro Gallegos, and Jasiel Spelman from Google Cloud Vulnerability Research have been credited with discovering and reporting the first five flaws. Security researcher Aleksei Gorban has been acknowledged for the symbolic-link race condition flaw.
"In the most severe CVE, an attacker only requires anonymous read access to a Rsync server, such as a public mirror, to execute arbitrary code on the machine the server is running on," Red Hat Product Security's Nick Tait said.
CERT/CC also noted that an attacker could combine CVE-2024-12084 and CVE-2024-12085 to achieve arbitrary code execution on a client that has a Rsync server running.
Patches for the vulnerabilities have been released in Rsync version 3.4.0, which was made available earlier today. For users who are unable to apply the update, the following mitigations are recommended -
- CVE-2024-12084 - Disable SHA* support by compiling with CFLAGS=-DDISABLE_SHA512_DIGEST and CFLAGS=-DDISABLE_SHA256_DIGEST
- CVE-2024-12085 - Compile with -ftrivial-auto-var-init=zero to zero the stack contents
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/01/google-cloud-researchers-uncover-flaws.html