Описание
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
A flaw was found in rsync. When rsync is configured to handle extended attributes (using the -X or --xattrs option), a remote attacker can exploit a use-after-free vulnerability. This occurs because the receive_xattr function incorrectly processes an untrusted length value during a sorting operation, leading to memory corruption. Successful exploitation can result in a denial of service, causing the rsync process to crash, and may potentially allow for arbitrary code execution.
Отчет
This is an Important flaw in rsync that allows a remote attacker to cause a denial of service or potentially execute arbitrary code. The vulnerability is present when rsync is used with extended attributes enabled via the -X or --xattrs option, which is not a default configuration. Exploitation requires the victim to explicitly enable this feature.
Меры по смягчению последствий
To mitigate this vulnerability, avoid using the -X or --xattrs options with rsync if extended attribute handling is not essential for your operations. Disabling these options prevents the vulnerable code path from being exercised. This may impact functionality that relies on extended attributes.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat Enterprise Linux 10 | rsync | Fixed | RHSA-2026:19152 | 19.05.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | rsync | Fixed | RHSA-2026:20696 | 26.05.2026 |
| Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | rsync | Fixed | RHSA-2026:25173 | 11.06.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | rsync | Fixed | RHSA-2026:25172 | 11.06.2026 |
| Red Hat Enterprise Linux 8 | rsync | Fixed | RHSA-2026:17481 | 14.05.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | rsync | Fixed | RHSA-2026:25170 | 11.06.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | rsync | Fixed | RHSA-2026:25170 | 11.06.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | rsync | Fixed | RHSA-2026:25190 | 11.06.2026 |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | rsync | Fixed | RHSA-2026:25190 | 11.06.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.4 High
CVSS3
Связанные уязвимости
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted len ...
EPSS
7.4 High
CVSS3