On 14 January 2025, details of 6 security vulnerabilities – some of which are critical – in rsync servers were published on the Open Source Software Security mailing list. These are the security vulnerabilities CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087, CVE-2024-12088 and CVE-2024-12747.
What is an rsync server?
An rsync server is a service that enables the efficient synchronisation and transfer of files between computers, based on differences between the source and destination directories. It uses the rsync protocol to transfer data, copying only the changed parts of files to save bandwidth. It is typically used for backups, file replication and server migrations, and is therefore relatively widespread.
The security vulnerabilities described here also affect rsync servers that use anonymous authentication. In the worst-case scenario, the vulnerabilities could be exploited to execute arbitrary code.
An overview of the six disclosed vulnerabilities
[1] Heap buffer overflow in rsync due to improper checksum length handling
CVE-ID: CVE-2024-12084
CVSS 3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Description: A heap buffer overflow in the rsync daemon, caused by improper processing of attacker-controlled checksum lengths (s2length). If MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH of 16 bytes, an attacker can write data outside the boundaries of the sum2-buffer.
Affected versions: 3.2.7 and earlier, but prior to 3.4.0
Reported by: Simon Scannell (Google), Pedro Gallegos (Google), Jasiel Spelman (Google)
Mitigation: Disable SHA support by compiling with CFLAGS=-DDISABLE_SHA512_DIGEST and CFLAGS=-DDISABLE_SHA256_DIGEST.
[2] Information leak via uninitialised stack contents
CVE-ID: CVE-2024-12085
CVSS 3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Description: A flaw in the rsync daemon when comparing file checksums allows an attacker to manipulate the checksum length (s2length) to force a comparison between a checksum and uninitialised memory, thereby reading uninitialised stack data byte by byte.
Affected versions: prior to 3.4.0
Reported by: Simon Scannell (Google), Pedro Gallegos (Google), Jasiel Spelman (Google)
Mitigation: Compile with -ftrivial-auto-var-init=zeroto set the stack contents to zero.
[3] Rsync Server Leaks Arbitrary Client Files
CVE-ID: CVE-2024-12086
CVSS 3.1: 6.1 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N)
Description: A server can enumerate the contents of arbitrary files on the client machine. When copying files from the client to the server, the rsync server sends local checksums to the client for verification. By using specially crafted checksum values for arbitrary files, an attacker can reconstruct the data of these files byte by byte based on the client’s responses.
Affected versions: prior to 3.4.0
Reported by: Simon Scannell (Google), Pedro Gallegos (Google), Jasiel Spelman (Google)
[4] Path Traversal Vulnerability in Rsync
CVE-ID: CVE-2024-12087
CVSS 3.1: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Description: A Path Traversal vulnerability triggered by the --inc-recursive , which is enabled by default for many client options and can also be enforced by the server. A lack of symlink verification, combined with deduplication checks per file list, allows a server to write files outside the destination directory specified by the client. A malicious server could thus place harmful files in any location on the client named according to valid paths.
Affected versions: prior to 3.4.0
Reported by: Simon Scannell (Google), Pedro Gallegos (Google), Jasiel Spelman (Google)
[5] –safe-links Option Bypass Leads to Path Traversal
CVE-ID: CVE-2024-12088
CVSS 3.1: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Description: When using the --safe-links rsync does not correctly check whether a symbolic link target itself contains a symbolic link. This leads to a Path Traversal vulnerability that could allow arbitrary files to be written outside the intended directory.
Affected versions: prior to 3.4.0
Reported by: Simon Scannell (Google), Pedro Gallegos (Google), Jasiel Spelman (Google)
[6] Race Condition in Rsync Handling of Symbolic Links
CVE-ID: CVE-2024-12747
CVSS 3.1: 5.6 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Description: A race condition occurs during symbolic link processing by rsync. By default, rsync skips symbolic links. If an attacker replaces a regular file with a symbolic link at the right moment, this default behaviour can be bypassed, allowing symbolic links to be followed. Depending on the privileges of the rsync process, an attacker could thereby disclose sensitive information and potentially escalate privileges.
Affected versions: prior to 3.4.0
Reporter: Aleksei Gorban (“loqpa”)
Source: openwall.com/lists/oss-security/2025/01/14/3
Mint Secure GmbH
What organisations should do now
Organisations using rsync servers should be prepared to apply patches promptly, as some of the security vulnerabilities are so serious that they could allow Remote Code Execution (RCE), i.e. the execution of arbitrary code remotely. Effective patch, release and vulnerability management can help you deal with these security vulnerabilities; we’d be happy to advise you on this.
Follow us on LinkedIn to stay up to date with critical security vulnerabilities such as these in the rsync server.
How Mint Secure supports you
We help you identify critical vulnerabilities such as these at an early stage and resolve them systematically.
Vulnerability scanning
Continuous scanning of your infrastructure for the early detection of critical CVEs such as those described here.
Patch & Release Management
Structured processes for the timely deployment of security updates on critical systems.
Penetration testing
Targeted testing of your infrastructure servers to uncover vulnerabilities such as Path Traversal or buffer overflows.
Do you use rsync servers? We can advise you on patch management and vulnerability scanning. Get in touch now.
Conclusion
With CVE-2024-12084 to CVE-2024-12088 and CVE-2024-12747, no fewer than six vulnerabilities – some of them critical – have been identified in rsync servers, ranging from a heap buffer overflow with a CVSS score of 9.8 to Path Traversal and race condition issues. Servers with anonymous authentication are particularly at risk and should be updated immediately to version 3.4.0 or later.
Structured patch and vulnerability management is the most effective protection against precisely such critical security vulnerabilities that arise at short notice.
Mint Secure can assist you in dealing with critical vulnerabilities such as these. Please get in touch with us.
