Описание
Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.
A flaw was found in rsync. A local attacker with filesystem access on the daemon host can exploit a symlink race vulnerability (CWE-367 Time-of-check to time-of-use) in rsync daemons configured with 'use chroot = no'. This allows the attacker to redirect path-based system calls, such as chmod, lchown, or unlink, outside the intended module. This could lead to unauthorized file operations or other security bypasses.
Отчет
Moderate: A symlink race vulnerability affects rsync daemons when configured with use chroot = no, allowing a local attacker with filesystem access to perform unauthorized file operations outside the intended module. This risk is present only when the non-default use chroot = no setting is active.
Меры по смягчению последствий
To mitigate this issue, ensure that the rsync daemon is configured with use chroot = yes. This can be achieved by editing the rsyncd.conf file, typically located at /etc/rsyncd.conf, and setting use chroot = yes within the relevant module configuration. After modifying the configuration, the rsync service must be restarted for the changes to take effect. This may temporarily interrupt active rsync operations.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rsync | Out of support scope | ||
| Red Hat Enterprise Linux 6 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 7 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 8 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 9 | rsync | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.3 Medium
CVSS3
Связанные уязвимости
Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.
Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.
Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls
Rsync version3.4.2 and prior contain symlink race condition vulnerabil ...
Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.
EPSS
6.3 Medium
CVSS3