CVE-2024-12084
published 2025-01-15CVE-2024-12084: A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in…
PriorityP275critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
72.06%
99.4th percentile
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| almalinux | almalinux | — | — |
| debian | rsync | < rsync 3.2.7-1+deb12u1 (bookworm) | rsync 3.2.7-1+deb12u1 (bookworm) |
| msrc | azl3_rsync_3.2.7-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rsync_3.4.1-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_rsync_3.2.5-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_rsync_3.4.1-1_on_cbl_mariner_2.0 | — | — |
| nixos | nixos | < 24.11 | 24.11 |
| nixos | nixos | — | — |
| paloalto | pan-os | — | — |
| redhat | enterprise_linux | — | — |
| samba | rsync | — | — |
| samba | rsync | — | — |
| samba | rsync | >= 0 < 3.2.7-1+deb12u1 | 3.2.7-1+deb12u1 |
| samba | rsync | >= 0 < 3.3.0+ds1-3 | 3.3.0+ds1-3 |
| samba | rsync | >= 0 < 3.3.0+ds1-3 | 3.3.0+ds1-3 |
| samba | rsync | >= 0 < 3.1.3-8ubuntu0.9 | 3.1.3-8ubuntu0.9 |
| samba | rsync | >= 0 < 3.1.3-8ubuntu0.8 | 3.1.3-8ubuntu0.8 |
| samba | rsync | >= 0 < 3.2.7-0ubuntu0.22.04.4 | 3.2.7-0ubuntu0.22.04.4 |
| samba | rsync | >= 0 < 3.2.7-0ubuntu0.22.04.3 | 3.2.7-0ubuntu0.22.04.3 |
| samba | rsync | >= 0 < 3.2.7-1ubuntu1.2 | 3.2.7-1ubuntu1.2 |
| samba | rsync | >= 0 < 3.2.7-1ubuntu1.1 | 3.2.7-1ubuntu1.1 |
| samba | rsync | >= 0 < 3.3.0-1ubuntu0.2 | 3.3.0-1ubuntu0.2 |
| samba | rsync | >= 0 < 3.3.0-1ubuntu0.1 | 3.3.0-1ubuntu0.1 |
| samba | rsync | >= 0 < 3.1.0-2ubuntu0.4+esm2 | 3.1.0-2ubuntu0.4+esm2 |
| samba | rsync | >= 0 < 3.1.0-2ubuntu0.4+esm1 | 3.1.0-2ubuntu0.4+esm1 |
Detection & IOCsextracted from sources · hover to see the quote
port873
bytes
|40|RSYNCD|3a|
bytes
|00 00 07|
bytes
|0e|
snort
alert tcp any any -> $HOME_NET 873 (msg:"ET EXPLOIT Samba rsync s2length Checksum Length Heap Buffer Overflow (CVE-2024-12084)"; flow:established,to_server; content:"|40|RSYNCD|3a|"; fast_pattern; content:"--server"; content:"--sender"; content:"|00 00 07|"; content:"|0e|"; distance:0; byte_test:1,&,0x80,0,relative; byte_test:4,>,16,9,relative,little; byte_test:4,<,65,9,relative,little; reference:cve,2024-12084; classtype:attempted-user; sid:2067354; rev:2; metadata:affected_product Samba, attack_target Server, created_at 2026_02_06, cve CVE_2024_12084, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, updated_at 2026_02_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Exploit traffic targets TCP port 873 (rsync daemon). Look for established connections to the rsync daemon containing the protocol banner |40|RSYNCD|3a| followed by --server and --sender flags, with a checksum length field (s2length) greater than 16 and less than 65 (byte_test:4,>,16,9,relative,little and byte_test:4,<,65,9,relative,little), indicating an attacker-controlled value exceeding SUM_LENGTH (16 bytes).
- →The vulnerability is triggered when MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), causing an out-of-bounds write in the sum2 buffer. Detection should focus on attacker-controlled s2length values larger than 16 bytes in rsync checksum negotiation. ↗
- →Only rsync versions 3.2.7 and 3.3.0 are affected. Prioritize detection and patching on hosts running these specific versions. ↗
- →Anonymous read access to an rsync daemon (rsyncd) is the highest-risk configuration. Attackers only need anonymous read access to trigger the vulnerability — no credentials required in default rsyncd configurations. ↗
- →The Snort/ET rule uses sid:2067354 rev:2. Monitor IDS/IPS alert logs for this SID firing on perimeter and internal sensors.
- ·Risk is significantly reduced when rsync is accessed via a remote-shell transport (e.g., SSH) rather than direct TCP to the rsync daemon, because shell authentication restricts the attack surface. ↗
- ·The default rsyncd configuration does not require authentication; anonymous read access is common on file-sharing/mirroring hosts, making those deployments fully exposed with no available mitigation short of patching. ↗
- ·Red Hat considers severity Critical only when anonymous read access is allowed; severity may be significantly reduced depending on configuration. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2025-0006 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2025-02-12·CVSS 7.1
CVE-2015-5312 [HIGH] PAN-SA-2025-0006 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2025-0006 Informational Bulletin: Impact of OSS CVEs in PAN-OS
T he Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2015-5312, CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, CVE-2016-4738, CVE-2018-1111, CVE-2018-14634, CVE-2018-18653, CVE-2019-0145, CVE-2019-8331, CVE-2020-0599, CVE-2020-14343, CVE-2020-14779, CVE-2020-27844, CVE-2020-29569, CVE-2021-21315, CVE-2021-27853, CVE-2021-27854, CVE-2021-27861, CVE-2021-27862, CVE-2021-3618, CVE-2021-3711, CVE-2022-2097, CVE-2022-22816, CVE-2022-40303, CVE-2022-41723, CVE-2022-41741, CVE-2022-41742, CVE-2023-3247, CVE-2023-38408, CVE-2023-44466, CVE-2023-50781, CVE-2023-50782, CVE-2024-12084, CV
Ubuntu
rsync regression
vendor_ubuntu·2025-02-10·CVSS 9.8
CVE-2024-12084 [CRITICAL] rsync regression
Title: rsync regression
Summary: USN-7206-3 caused some regression in rsync.
USN-7206-3 fixed vulnerabilities in rsync for Ubuntu 24.10. The update
introduced a regression in rsync. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
did not properly handle checksum lengths. An attacker could use this
issue to execute arbitrary code. (CVE-2024-12084)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
compared checksums with uninitialized memory. An attacker could exploit
this issue to leak sensitive information. (CVE-2024-12085)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
incorrectly handled file checksums. A malicious
Ubuntu
rsync vulnerabilities
vendor_ubuntu·2025-01-28·CVSS 9.8
CVE-2024-12087 [CRITICAL] rsync vulnerabilities
Title: rsync vulnerabilities
Summary: Several security issues were fixed in rsync.
USN-7206-1 fixed vulnerabilities in Ubuntu 14.04 LTS to Ubuntu 24.04 LTS.
This update provides the corresponding updates for Ubuntu 24.10.
Original advisory details:
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
did not properly handle checksum lengths. An attacker could use this
issue to execute arbitrary code. (CVE-2024-12084)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
compared checksums with uninitialized memory. An attacker could exploit
this issue to leak sensitive information. (CVE-2024-12085)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
incorrectly handled file checksums. A malicious server could use this
to exp
Ubuntu
rsync regression
vendor_ubuntu·2025-01-16·CVSS 9.8
CVE-2024-12084 [CRITICAL] rsync regression
Title: rsync regression
Summary: USN-7206-1 caused some regression in rsync.
USN-7206-1 fixed vulnerabilities in rsync. The update introduced a
regression in rsync. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
did not properly handle checksum lengths. An attacker could use this
issue to execute arbitrary code. (CVE-2024-12084)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
compared checksums with uninitialized memory. An attacker could exploit
this issue to leak sensitive information. (CVE-2024-12085)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
incorrectly handled file checksums. A malicious server could use
Microsoft
Rsync: heap buffer overflow in rsync due to improper checksum length handling
vendor_msrc·2025-01-14·CVSS 9.8
CVE-2024-12084 [CRITICAL] CWE-122 Rsync: heap buffer overflow in rsync due to improper checksum length handling
Rsync: heap buffer overflow in rsync due to improper checksum length handling
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Ubuntu
rsync vulnerabilities
vendor_ubuntu·2025-01-14·CVSS 9.8
CVE-2024-12085 [CRITICAL] rsync vulnerabilities
Title: rsync vulnerabilities
Summary: Several security issues were fixed in rsync.
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
did not properly handle checksum lengths. An attacker could use this
issue to execute arbitrary code. (CVE-2024-12084)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
compared checksums with uninitialized memory. An attacker could exploit
this issue to leak sensitive information. (CVE-2024-12085)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
incorrectly handled file checksums. A malicious server could use this
to expose arbitrary client files. (CVE-2024-12086)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
mishandled symlinks for some settings. An attacke
Red Hat
rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
vendor_redhat·2025-01-14·CVSS 9.8
CVE-2024-12084 [CRITICAL] CWE-122 rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
Statement: This vulnerability only affects a limited range of Rsync versions, rsync-3.2.7 and rsync-3.3.0. Red Hat Enterprise Linux does not ship the
Debian
CVE-2024-12084: rsync - A heap-based buffer overflow flaw was found in the rsync daemon. This issue is d...
vendor_debian·2024·CVSS 9.8
CVE-2024-12084 [CRITICAL] CVE-2024-12084: rsync - A heap-based buffer overflow flaw was found in the rsync daemon. This issue is d...
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
Scope: local
bookworm: resolved (fixed in 3.2.7-1+deb12u1)
bullseye: resolved
forky: resolved (fixed in 3.3.0+ds1-3)
sid: resolved (fixed in 3.3.0+ds1-3)
trixie: resolved (fixed in 3.3.0+ds1-3)
OSV
rsync regression
osv·2025-02-10·CVSS 9.8
CVE-2024-12084 [CRITICAL] rsync regression
rsync regression
USN-7206-3 fixed vulnerabilities in rsync for Ubuntu 24.10. The update
introduced a regression in rsync. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
did not properly handle checksum lengths. An attacker could use this
issue to execute arbitrary code. (CVE-2024-12084)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
compared checksums with uninitialized memory. An attacker could exploit
this issue to leak sensitive information. (CVE-2024-12085)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
incorrectly handled file checksums. A malicious server could use this
to expose arbitrary client files. (CVE-
OSV
rsync vulnerabilities
osv·2025-01-28·CVSS 9.8
CVE-2024-12084 [CRITICAL] rsync vulnerabilities
rsync vulnerabilities
USN-7206-1 fixed vulnerabilities in Ubuntu 14.04 LTS to Ubuntu 24.04 LTS.
This update provides the corresponding updates for Ubuntu 24.10.
Original advisory details:
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
did not properly handle checksum lengths. An attacker could use this
issue to execute arbitrary code. (CVE-2024-12084)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
compared checksums with uninitialized memory. An attacker could exploit
this issue to leak sensitive information. (CVE-2024-12085)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
incorrectly handled file checksums. A malicious server could use this
to expose arbitrary client files. (CVE-2024-12086)
Simon Scannell,
OSV
rsync regression
osv·2025-01-16·CVSS 9.8
CVE-2024-12084 [CRITICAL] rsync regression
rsync regression
USN-7206-1 fixed vulnerabilities in rsync. The update introduced a
regression in rsync. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
did not properly handle checksum lengths. An attacker could use this
issue to execute arbitrary code. (CVE-2024-12084)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
compared checksums with uninitialized memory. An attacker could exploit
this issue to leak sensitive information. (CVE-2024-12085)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
incorrectly handled file checksums. A malicious server could use this
to expose arbitrary client files. (CVE-2024-12086)
Simo
OSV
CVE-2024-12084: A heap-based buffer overflow flaw was found in the rsync daemon
osv·2025-01-15·CVSS 9.8
CVE-2024-12084 [CRITICAL] CVE-2024-12084: A heap-based buffer overflow flaw was found in the rsync daemon
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
GHSA
GHSA-85h7-m8c3-v9wc: A heap-based buffer overflow flaw was found in the rsync daemon
ghsa_unreviewed·2025-01-15
CVE-2024-12084 [CRITICAL] CWE-122 GHSA-85h7-m8c3-v9wc: A heap-based buffer overflow flaw was found in the rsync daemon
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
OSV
Several security issues were fixed in rsync
osv·2025-01-14·CVSS 9.8
CVE-2024-12084 [CRITICAL] Several security issues were fixed in rsync
Several security issues were fixed in rsync
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
did not properly handle checksum lengths. An attacker could use this
issue to execute arbitrary code. (CVE-2024-12084)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
compared checksums with uninitialized memory. An attacker could exploit
this issue to leak sensitive information. (CVE-2024-12085)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
incorrectly handled file checksums. A malicious server could use this
to expose arbitrary client files. (CVE-2024-12086)
Simon Scannell, Pedro Gallegos, and Jasiel Spelman discovered that rsync
mishandled symlinks for some settings. An attacker could exploit this
to write files outs
Suricata
ET EXPLOIT Samba rsync s2length Checksum Length Heap Buffer Overflow (CVE-2024-12084)
suricata·2026-02-06·CVSS 9.8
CVE-2024-12084 [CRITICAL] ET EXPLOIT Samba rsync s2length Checksum Length Heap Buffer Overflow (CVE-2024-12084)
ET EXPLOIT Samba rsync s2length Checksum Length Heap Buffer Overflow (CVE-2024-12084)
Rule: alert tcp any any -> $HOME_NET 873 (msg:"ET EXPLOIT Samba rsync s2length Checksum Length Heap Buffer Overflow (CVE-2024-12084)"; flow:established,to_server; content:"|40|RSYNCD|3a|"; fast_pattern; content:"--server"; content:"--sender"; content:"|00 00 07|"; content:"|0e|"; distance:0; byte_test:1,&,0x80,0,relative; byte_test:4,>,16,9,relative,little; byte_test:4,<,65,9,relative,little; reference:cve,2024-12084; classtype:attempted-user; sid:2067354; rev:2; metadata:affected_product Samba, attack_target Server, created_at 2026_02_06, cve CVE_2024_12084, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, updated_at 2026_02_17, mitre_tactic_id TA0001,
Sigma
Suspicious Invocation of Shell via Rsync
sigma·CVSS 9.8
CVE-2024-12084 [CRITICAL] Suspicious Invocation of Shell via Rsync
Suspicious Invocation of Shell via Rsync
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Detection:
condition: selection and not 1 of filter_main_*
filter_main_expected:
CommandLine|contains: ' -e '
selection:
Image|endswith:
- /ash
- /bash
- /csh
- /dash
- /ksh
- /sh
- /tcsh
- /zsh
ParentImage|endswith:
- /rsync
- /rsyncd
Log Source: category: process_creation
product: linux
No public exploits indexed.
Wiz
Crying Out Cloud Newsletter - February 2025 | Wiz
blogs_wiz·2025-02-06
Crying Out Cloud Newsletter - February 2025 | Wiz
Welcome back! In this edition, we bring you the latest in cloud security – noteworthy incidents, exclusive data, and crucial vulnerabilities. Let's dive in.
Here are our top picks of cloud security highlights!
Hype or no hype – Codefinger Ransomware Campaign Targeting S3 Buckets
Codefinger is a ransomware campaign that exploits AWS Server-Side Encryption with Customer Provided Keys (SSE-C) to encrypt data in Amazon S3 buckets. While this campaign has sparked widespread concern, we argue that the panic is unwarranted. Many have focused on detecting unwanted SSE-C encryption as a mitigation strategy, but encryption is merely a tactic chosen by the attacker after gaining access—it is not the core issue. The real concern, which is neither new nor unique, is the use of compromised credential
Bleepingcomputer
QNAP fixes six Rsync vulnerabilities in NAS backup, recovery app
blogs_bleepingcomputer·2025-01-23·CVSS 9.8
[CRITICAL] QNAP fixes six Rsync vulnerabilities in NAS backup, recovery app
## QNAP fixes six Rsync vulnerabilities in NAS backup, recovery app
## Sergiu Gatlan
QNAP has fixed six rsync vulnerabilities that could let attackers gain remote code execution on unpatched Network Attached Storage (NAS) devices.
Rsync is an open-source file synchronization tool that supports direct file syncing via its daemon, SSH transfers via SSH, and incremental transfers that save time and bandwidth.
It's widely used by many backup solutions like Rclone, DeltaCopy, and ChronoSync, as well as in cloud and server management operations and public file distribution.
The flaws are tracked as CVE-2024-12084 (heap buffer overflow), CVE-2024-12085 (information leak via uninitialized stack), CVE-2024-12086 (server leaks arbitrary client files), CVE-2024-12087 (path traversal via --inc-re
Bleepingcomputer
Over 660,000 Rsync servers exposed to code execution attacks
blogs_bleepingcomputer·2025-01-15·CVSS 9.8
[CRITICAL] Over 660,000 Rsync servers exposed to code execution attacks
## Over 660,000 Rsync servers exposed to code execution attacks
## Bill Toulas
The tool is utilized extensively by backup systems like Rclone, DeltaCopy, ChronoSync, public file distribution repositories, and cloud and server management operations.
The Rsync flaws were discovered by Google Cloud and independent security researchers and can be combined to create powerful exploitation chains that lead to remote system compromise.
"In the most severe CVE, an attacker only requires anonymous read access to a rsync server, such as a public mirror, to execute arbitrary code on the machine the server is running on," reads the bulletin published on Openwall .
The six flaws are summarized below:
Heap Buffer Overflow (CVE-2024-12084) : Vulnerability arising from improper handling of checksum l
arXiv
NanoTag: Systems Support for Efficient Byte-Granular Overflow Detection on ARM MTE
arxiv_fulltext·2025-10-13
NanoTag: Systems Support for Efficient Byte-Granular Overflow Detection on ARM MTE
arabic
plain
firstpage
plain
firstpage
[]
[L] Preprint. Under review.
## Introduction
s, like buffer overflows and s, are the root causes of a vast majority of software vulnerabilities, 70% of Microsoft and 51% of Android vulnerabilities.
Consequently, researchers have proposed a wide range of static and dynamic techniques over the years .
Among these techniques, memory safety sanitizers have been proven especially useful in detecting such s as they observe the executions of
applications directly without any false positives.
However, the high overhead of these
sanitizers limits their adoption in in-production deployment or fuzzing.
For example, Google reports that both (ASAN) and (HWASAN) have a similar CPU overhead of 2 . This issue is even worse for closed-source binaries, where sta
Bugzilla
CVE-2024-12084 rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
bugzilla·2024-12-05·CVSS 9.8
CVE-2024-12084 [CRITICAL] CVE-2024-12084 rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
CVE-2024-12084 rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling
The vulnerability arises because the checksum length (s2length) is derived from an unvalidated protocol input (MAX_DIGEST_LEN), which can exceed the size of the pre-allocated buffer (SUM_LENGTH), allowing attackers to exploit this behavior.
https://access.redhat.com/errata/RHBA-2025:6470https://access.redhat.com/security/cve/CVE-2024-12084https://bugzilla.redhat.com/show_bug.cgi?id=2330527https://kb.cert.org/vuls/id/952657http://www.openwall.com/lists/oss-security/2025/01/14/6https://security.netapp.com/advisory/ntap-20250131-0002/https://www.kb.cert.org/vuls/id/952657https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
2025-01-15
Published