Описание
rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.
A flaw was found in rsync. A malicious receiver can exploit an out-of-bounds read vulnerability in the sender-side block matching logic. By sending a specially crafted checksum block with a length of zero, an attacker can trigger memory access before the start of an allocated buffer. This can lead to a denial of service on the sender side.
Отчет
A Moderate denial of service flaw exists in rsync, where a malicious receiver can trigger an out-of-bounds read on the sending system. This vulnerability requires the sender to connect to a specially crafted malicious rsync server, which can lead to service disruption of file synchronization operations.
Меры по смягчению последствий
Disable unused rsyncd services (systemctl disable --now rsyncd), and if actively serving files, restrict port 873 to trusted clients to prevent untrusted pull requests from crashing the daemon. When operating as a client, only push data (rsync src/ host:dst/) to fully trusted receivers, as the out-of-bounds read is triggered by the receiving end.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 6 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 7 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 8 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 9 | rsync | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.
rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.
rsyncbefore 3.5.0contains an out-of-bounds read vulnerability in the s ...
EPSS
6.5 Medium
CVSS3