CVE-2024-12084
CVE-2024-12084 · Rsync: heap buffer overflow in rsync due to improper checksum length handling
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
CVSS 9.8 · Critical · EPSS 72.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
- Versions
- ≥ 0:3.4.1-2.el10: Not affected (rpm)
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
red hat enterprise linux 8
No fix published
red hat enterprise linux 9
No fix published
red hat openshift container platform 4
No fix published
rsync Debian:12
- Versions
- 3.2.7-1
- Affected ranges
- ECOSYSTEM: < 3.2.7-1+deb12u1
Update to 3.2.7-1+deb12u1
rsync Debian:13
- Affected ranges
- ECOSYSTEM: < 3.3.0+ds1-3
Update to 3.3.0+ds1-3
rsync Debian:14
- Affected ranges
- ECOSYSTEM: < 3.3.0+ds1-3
Update to 3.3.0+ds1-3
rsync Ubuntu:22.04:LTS
- Versions
- 3.2.3-4ubuntu1
- 3.2.3-4ubuntu2
- 3.2.3-8ubuntu1
- 3.2.3-8ubuntu2
- 3.2.3-8ubuntu3
- 3.2.3-8ubuntu3.1
- 3.2.7-0ubuntu0.22.04.2
- Affected ranges
- ECOSYSTEM: < 3.2.7-0ubuntu0.22.04.3
Update to 3.2.7-0ubuntu0.22.04.3
rsync Ubuntu:24.04:LTS
- Versions
- 3.2.7-1
- 3.2.7-1build1
- 3.2.7-1build2
- 3.2.7-1ubuntu1
- Affected ranges
- ECOSYSTEM: < 3.2.7-1ubuntu1.1
Update to 3.2.7-1ubuntu1.1
Original sources
- https://access.redhat.com/errata/RHBA-2025:6470
- https://access.redhat.com/security/cve/CVE-2024-12084
- https://bugzilla.redhat.com/show_bug.cgi?id=2330527
- https://kb.cert.org/vuls/id/952657
- https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
- http://www.openwall.com/lists/oss-security/2025/01/14/6
- https://security.netapp.com/advisory/ntap-20250131-0002/
- https://www.kb.cert.org/vuls/id/952657
- https://nvd.nist.gov/vuln/detail/CVE-2024-12084