Rsync Daemon Checksum Manipulation Vulnerability - CVE-2024-12085
Summary
CVE-2024-12084: A flaw was found in rsync which could be triggered when rsync compares file checksums. Affects rsync across 2 version ranges.
< 3.4.0-r0
< 6c8ca91c731b7bf2b081694bda85b7dadc2b7aff
Fixed in 3.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Rsync is a widely used utility for efficiently transferring and synchronizing files across computer systems. It employs a delta-transfer algorithm, which minimizes data transfer by only sending the differences between source and destination files. The rsync daemon allows for remote file synchronization and is commonly utilized in backup solutions and system administration. However, a recently discovered vulnerability in the rsync daemon could lead to potential data leaks, making it crucial for users to understand and address this issue.
Vulnerability Detail
A flaw was found in the rsync daemon that can be exploited when rsync compares file checksums. This vulnerability allows an attacker to manipulate the checksum length (s2length), leading to a comparison between a checksum and uninitialized memory. As a result, this can leak one byte of uninitialized stack data at a time, posing a significant risk of information disclosure. The vulnerability affects multiple versions of rsync across different Debian ecosystems, making it imperative for users to take action to mitigate potential risks.
How To Fix
Minimum fixed version
3.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the rsync daemon by configuring firewall rules or using SSH for secure file transfers, thereby minimizing exposure to potential attacks until the package is updated.
Conclusion
The vulnerability CVE-2024-12085 in the rsync daemon poses a significant risk of data leakage through manipulated checksum comparisons. Users are strongly advised to update their rsync packages to the latest patched versions to mitigate this risk. Additionally, temporary workarounds can be employed to enhance security until updates are applied.
See every vulnerability recorded for rsync →
FAQ
CVE-2024-12085 is a vulnerability in the rsync daemon that allows attackers to manipulate checksum comparisons, potentially leaking sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is the leakage of uninitialized stack data, which could expose sensitive information to attackers.
Yes, a patched version of rsync is available for Debian 12. Users should update to version 3.2.7-1+deb12u1 or later.
If immediate updates are not possible, consider implementing firewall rules or using SSH for secure file transfers as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
