Описание
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
A flaw was found in rsync. A remote attacker can exploit a signed integer overflow vulnerability in the I/O timeout implementation by sending specially crafted messages. These messages can disable connection timeouts, causing idle or stalled connections to persist indefinitely. This leads to resource exhaustion, preventing legitimate users from accessing the rsync service and resulting in a denial of service.
Отчет
This is a Moderate denial of service flaw in rsync, where a remote, unauthenticated attacker can exhaust system resources. By injecting specially crafted messages, an attacker can disable connection timeouts, causing rsync daemon connections to remain active indefinitely. This can lead to resource exhaustion, preventing legitimate users from accessing the rsync service. The impact is limited to denial of service and does not allow for arbitrary code execution or data compromise.
Меры по смягчению последствий
Only run rsync against trusted remotes. Restrict which hosts local rsync and rsync-bpc may reach. A peer MSG_IO_TIMEOUT can disable or overflow the client’s --timeout; daemon hosts allow does not bind this.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 6 | rsync | Not affected | ||
| Red Hat Enterprise Linux 7 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 8 | rsync | Fix deferred | ||
| Red Hat Enterprise Linux 9 | rsync | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT
rsync 3.1.0 before 3.5.0contains a signed integer overflow vulnerabili ...
EPSS
6.5 Medium
CVSS3