Critical Memory Leak Vulnerability in rsync Package
Summary
ALPINE-CVE-2024-12085: A flaw was found in rsync which could be triggered when rsync compares file checksums. Affects rsync versions < 3.4.0-r0. Fixed in 3.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rsync is a widely used utility for efficiently transferring and synchronizing files across computer systems. It is known for its speed and flexibility, allowing users to perform incremental backups and mirror data. However, a recent vulnerability has been identified that affects multiple versions of the rsync package in Alpine Linux, potentially exposing sensitive data through memory leaks.
Vulnerability Detail
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory, leading to the leakage of one byte of uninitialized stack data at a time. This vulnerability, identified as CVE-2024-12085, poses a significant risk as it could allow attackers to gain access to sensitive information stored in memory.
How To Fix
Minimum fixed version
3.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionality of rsync that involves checksum comparisons until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The rsync package in Alpine Linux has a critical vulnerability (CVE-2024-12085) that can lead to memory leaks and potential data exposure. Users are advised to update to the patched version 3.4.0-r0 to mitigate this risk. Regular monitoring for vulnerabilities is essential to maintain software security.
See every vulnerability recorded for rsync →
FAQ
CVE-2024-12085 is a vulnerability in the rsync package that allows attackers to leak uninitialized memory data through manipulated checksum comparisons.
The vulnerability affects rsync versions in Alpine Linux from 0 up to but not including 3.4.0-r0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to access sensitive information stored in memory, leading to data breaches.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
