CVE-2024-12084: rsync security updates
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12084?
CVE-2024-12084 is classified as a high-severity vulnerability due to its potential for exploitation and impact on system integrity.
How do I fix CVE-2024-12084?
To fix CVE-2024-12084, upgrade to the patched versions of rsync, which include 3.2.3-4+deb11u1, 3.2.3-4+deb11u3, 3.2.7-1+deb12u2, or 3.3.0+ds1-4.
What are the consequences of exploiting CVE-2024-12084?
Exploitation of CVE-2024-12084 can lead to a heap-based buffer overflow, resulting in arbitrary code execution on the affected system.
Which versions of rsync are affected by CVE-2024-12084?
CVE-2024-12084 affects rsync versions up to and including 3.2.7-1.
Is CVE-2024-12084 specific to any operating system?
CVE-2024-12084 primarily affects the rsync daemon used in Debian-based systems.