Description A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Exploitability: 3.9 | Impact: 5.9 Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High
Affected Packages5 packages Also affects: Almalinux 10.0, Enterprise Linux 10.0
🔴 Vulnerability Details7 OSV rsync regression ↗ 2025-02-10 ▶ OSV rsync vulnerabilities ↗ 2025-01-28 ▶ OSV rsync regression ↗ 2025-01-16 ▶ CVEList Rsync: heap buffer overflow in rsync due to improper checksum length handling ↗ 2025-01-15 ▶ OSV CVE-2024-12084: A heap-based buffer overflow flaw was found in the rsync daemon ↗ 2025-01-15 ▶ Show 2 more
🔍 Detection Rules2 Suricata ET EXPLOIT Samba rsync s2length Checksum Length Heap Buffer Overflow (CVE-2024-12084) ↗ 2026-02-06 ▶ Sigma Suspicious Invocation of Shell via Rsync ↗ ▶
📋 Vendor Advisories7 Ubuntu rsync regression ↗ 2025-02-10 ▶ Ubuntu rsync vulnerabilities ↗ 2025-01-28 ▶ Ubuntu rsync regression ↗ 2025-01-16 ▶ Microsoft Rsync: heap buffer overflow in rsync due to improper checksum length handling ↗ 2025-01-14 ▶ Ubuntu rsync vulnerabilities ↗ 2025-01-14 ▶ Show 2 more