Описание
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.
An out-of-bounds write vulnerability in rsync's parse_size_arg() function allows a remote attacker to cause memory corruption. The flaw is triggered when snprintf() truncates a formatted size string, resulting in an incorrect memory array index. Exploitation can lead to a denial of service and potentially compromise data integrity.
Отчет
This Moderate impact flaw in rsync stems from an out-of-bounds write in the parse_size_arg() function. Although no privileges or user interaction are required, the high attack complexity indicates that exploitation is not straightforward. Successful exploitation could lead to memory corruption, potentially causing a denial of service or compromising data integrity on affected Red Hat systems.
Меры по смягчению последствий
If rsync is configured to run as a daemon, restrict network access to trusted hosts using firewall rules. For example, to limit access to localhost:
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="873" protocol="tcp" source address="127.0.0.1" accept'
firewall-cmd --reload
This may impact legitimate remote rsync operations. If rsync is not used as a daemon, ensure that only trusted sources are used for rsync operations.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | rsync | Not affected | ||
| Red Hat Enterprise Linux 7 | rsync | Not affected | ||
| Red Hat Enterprise Linux 8 | rsync | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected | ||
| Red Hat Enterprise Linux 10 | rsync | Fixed | RHSA-2026:67463 | 14.09.2026 |
| Red Hat Enterprise Linux 9 | rsync | Fixed | RHSA-2026:67462 | 14.09.2026 |
| Red Hat Enterprise Linux 9 | rsync | Fixed | RHSA-2026:67462 | 14.09.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
rsync 3.2.3before 3.5.0contains an out-of-bounds write in parse_size_a ...
6.5 Medium
CVSS3