Rsync Symbolic Link Race Condition Vulnerability - CVE-2024-12747
Summary
CVE-2024-12747: A flaw was found in rsync. Affects rsync versions < 3.4.0-r0. Fixed in 3.4.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rsync is a widely used utility for efficiently transferring and synchronizing files across computer systems. It is known for its ability to minimize data transfer by only sending the differences between source and destination files. The tool operates by utilizing a client-server model and supports various protocols, making it versatile for different environments. However, it has a vulnerability related to its handling of symbolic links, which can lead to security risks if exploited.
Vulnerability Detail
A flaw was found in rsync that arises from a race condition during its handling of symbolic links. By default, rsync skips symbolic links when processing files. However, if an attacker can replace a regular file with a symbolic link at a critical moment, they can bypass this default behavior. This could allow the attacker to traverse symbolic links and potentially leak sensitive information. Depending on the privileges of the rsync process, this vulnerability could lead to privilege escalation, making it a significant security concern.
How To Fix
Minimum fixed version
3.4.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using rsync with symbolic links until the package is updated. Additionally, consider using the '--no-links' option when running rsync to prevent it from processing symbolic links altogether.
Conclusion
CVE-2024-12747 is a critical vulnerability in rsync that arises from a race condition in its handling of symbolic links. Users are advised to update their rsync installations to the latest patched versions to mitigate the risks associated with this vulnerability. Temporary workarounds are available, but updating is the best course of action.
See every vulnerability recorded for rsync →
FAQ
CVE-2024-12747 is a vulnerability in rsync that allows attackers to exploit a race condition in the handling of symbolic links, potentially leading to information leakage and privilege escalation.
You can check your version of rsync by running 'rsync --version' in the terminal. If you are using a version prior to 3.2.7-1+deb12u1 on Debian 12, you are at risk.
The vulnerability can lead to sensitive information leakage and may allow attackers to escalate privileges depending on the permissions of the rsync process.
Yes, you can use Vulert to monitor and alert you in real-time for open-source vulnerabilities in your software. It requires only a manifest file like package-lock.json.
You can find more information about CVE-2024-12747 on the official CVE database or by visiting the provided links in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
