Описание
Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
A flaw was found in rsync. A malicious rsync server can exploit an out-of-bounds read vulnerability in the recv_files() function. By manipulating compatibility flags and transfer records, the server can cause a connecting client to attempt to read memory outside of allocated bounds. This can lead to a segmentation fault, resulting in a denial of service for the client.
Отчет
This Moderate impact flaw in rsync clients allows a remote, unauthenticated attacker to cause a denial-of-service by crafting a malicious rsync server. When a client pulls from such a server, an out-of-bounds read occurs due to an incomplete fix, leading to a deterministic crash. This affects any rsync client performing a normal pull from an attacker-controlled URL, as the inc_recurse option, which is enabled by default, facilitates the exploit.
Меры по смягчению последствий
To mitigate this issue, rsync clients can be configured to disable incremental recursion when pulling from untrusted sources. This can be achieved by using the --no-inc-recursive option.
Example:
rsync --no-inc-recursive [OPTIONS] SOURCE DESTINATION
Disabling incremental recursion may affect the efficiency of transfers for large, frequently updated directories.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rsync | Out of support scope | ||
| Red Hat Enterprise Linux 6 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 7 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 8 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 9 | rsync | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
Rsync version3.4.2 and prior contain a receiver-side out-of-bounds arr ...
Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
EPSS
6.5 Medium
CVSS3