Heap-based Buffer Overflow Affecting rsync package, versions [3.2.7,3.4.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-UNMANAGED-RSYNC-8627647
- published15 Jan 2025
- disclosed14 Jan 2025
- creditSimon Scannell, Pedro Gallegos, and Jasiel Spelman at Google Cloud Vulnerability Research
Introduced: 14 Jan 2025
NewCVE-2024-12084 (opens in a new tab)How to fix?
Upgrade rsync to version 3.4.0 or higher.
Overview
Affected versions of this package are vulnerable to Heap-based Buffer Overflow due to improper handling of attacker-controlled checksum lengths s2length in the code.
An anonymous client can leverage this overflow, together with the stack memory exposure described in CVE-2024-12085 to execute code on an affected server.
Alternatively, a malicious rsync server could gain read/write access to arbitrary files on a connected client.
Workaround
This vulnerability can be avoided by compiling with CFLAGS=-DDISABLE_SHA512_DIGEST and CFLAGS=-DDISABLE_SHA256_DIGEST to disable SHA support.