{
  "threat_severity" : "Critical",
  "public_date" : "2025-01-14T15:06:00Z",
  "bugzilla" : {
    "description" : "rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling",
    "id" : "2330527",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2330527"
  },
  "cvss3" : {
    "cvss3_base_score" : "9.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-122",
  "details" : [ "A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.", "A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer." ],
  "statement" : "This vulnerability only affects a limited range of Rsync versions, rsync-3.2.7 and rsync-3.3.0.   Red Hat Enterprise Linux does not ship these versions of Rsync and is not affected.\nRed Hat considers the severity of this vulnerability to be Critical only in cases where anonymous read access is allowed. Depending on the configuration and implementation choices, the severity may be significantly reduced for your organization.\nIn all supported versions of Red Hat Enterprise Linux, Rsync is not configured to run as a service by default.\nThere are two different methods for utilizing Rsync from a remote system: contacting an Rsync daemon directly with TCP or using a remote-shell program as the transport (such as ssh or rsh). The risk of this vulnerability changes depending on which connection method is used.\nThe default configuration of an Rsync daemon (rsyncd) running as a service does not require authentication. While rsyncd can be configured to require users to provide valid credentials, anonymous read access is a common configuration used by file sharing and mirroring hosts. The capabilities of the rsyncd process may vary depending on the user configured to run the Rsync daemon. In this scenario, an attacker only requires anonymous read access to a Rsync server in order to trigger this vulnerability. \nRemote-shell programs provide a layer of defense because they enforce users to have valid credentials while initiating the shell connection. When Rsync is invoked via this method, it spawns as a child of the session and will not remain running indefinitely. Since the process is spawned within the security context of the user, an attacker who is able to exploit this vulnerability remains restricted to the capabilities of the user account used to initiate the session. Authentication and network restrictions significantly reduce the attack surface and restricting permissions for remote shell users is always encouraged to limit the impact of compromised credentials.",
  "acknowledgement" : "Red Hat would like to thank Jasiel Spelman (Google), Pedro Gallegos (Google), and Simon Scannell (Google) for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-05-13T00:00:00Z",
    "advisory" : "RHBA-2025:6470",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.0",
    "package" : "rsync-0:3.4.1-2.el10"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "rsync",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "rsync",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "rsync",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "rsync",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "rhcos",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-12084\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-12084\nhttps://kb.cert.org/vuls/id/952657" ],
  "name" : "CVE-2024-12084",
  "mitigation" : {
    "value" : "Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances.\nAdditionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). \nSystems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.",
    "lang" : "en:us"
  },
  "csaw" : false
}