CVE-2024-12084: rsync security updates
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAXDIGESTLEN exceeds the fixed SUMLENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
Other sources
rsync has been updated to version 3.4.1 which contains fixes for security vulnerabilities including CVE-2024-12084 and CVE-2024-12088.
— GitLab
Rsync: heap buffer overflow in rsync due to improper checksum length handling
— Microsoft
The vulnerability arises because the checksum length (s2length) is derived from an unvalidated protocol input (MAXDIGESTLEN), which can exceed the size of the pre-allocated buffer (SUMLENGTH), allowing attackers to exploit this behavior.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.2.3-4+deb11u1Fixed in 3.2.3-4+deb11u3Fixed in 3.2.7-1+deb12u2Fixed in 3.3.0+ds1-4 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.4.1Patch CVE-2024-12084 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.4.1Patch CVE-2024-12088 - Configuration
Use the `--safe-links` option so the rsync client verifies symbolic link destinations sent from the server (per material: vulnerability arises when using `--safe-links` due to improper verification of nested symbolic links).
rsync --safe-links = enabled - Configuration
Avoid/disable the `--inc-recursive` option, because it is a default-enabled behavior for many client options and can be enabled by the server, enabling symlink/race-condition paths that allow writing outside the intended destination directory.
rsync --inc-recursive = disabled
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-12084?
CVE-2024-12084 is classified as a high-severity vulnerability due to its potential for exploitation and impact on system integrity.
How do I fix CVE-2024-12084?
To fix CVE-2024-12084, upgrade to the patched versions of rsync, which include 3.2.3-4+deb11u1, 3.2.3-4+deb11u3, 3.2.7-1+deb12u2, or 3.3.0+ds1-4.
What are the consequences of exploiting CVE-2024-12084?
Exploitation of CVE-2024-12084 can lead to a heap-based buffer overflow, resulting in arbitrary code execution on the affected system.
Which versions of rsync are affected by CVE-2024-12084?
CVE-2024-12084 affects rsync versions up to and including 3.2.7-1.
Is CVE-2024-12084 specific to any operating system?
CVE-2024-12084 primarily affects the rsync daemon used in Debian-based systems.