Описание
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
Отчет
This vulnerability is rated as having Important impact as it helps bypass Address Space Layout Randomization (ASLR). ASLR is a memory protection system which makes the exploitation of memory corruption vulnerabilities more difficult.
Меры по смягчению последствий
Seeing as this vulnerability relies on information leakage coming from the presence of data in the uninitialized memory of the sum2 buffer, a potential mitigation involves compiling rsync with the -ftrivial-auto-var-init=zero option set. This mitigates the issue because it initializes the sum2 variable's memory with zeroes to prevent uninitialized memory disclosure.
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
A flaw was found in rsync which could be triggered when rsync compares ...
EPSS
7.5 High
CVSS3