CVE-2024-12747: Rsync: race condition in rsync handling symbolic links
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12747?
CVE-2024-12747 is considered a high-severity vulnerability due to its potential exploitation through a race condition in rsync.
How do I fix CVE-2024-12747?
To fix CVE-2024-12747, upgrade rsync to version 3.2.3-4+deb11u3, 3.2.7-1+deb12u2, or 3.3.0+ds1-4.
Which versions of rsync are affected by CVE-2024-12747?
Rsync versions up to and including 3.2.3-4+deb11u1 and 3.2.7-1 are affected by CVE-2024-12747.
What type of vulnerability is CVE-2024-12747?
CVE-2024-12747 is a race condition vulnerability occurring during the handling of symbolic links in rsync.
Can CVE-2024-12747 be exploited remotely?
Yes, CVE-2024-12747 can be exploited remotely if an attacker can replace a regular file with a symbolic link during rsync operations.