{"id":"CVE-2024-12084","published":"2025-01-15T14:16:35Z","modified":"2026-10-21T16:06:50Z","title":"Rsync: heap buffer overflow in rsync due to improper checksum length handling","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","tier":"core","eol":null,"affectedVersions":[{"vendor":null,"product":null,"versions":["3.2.7","3.3.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","versions":["all versions"]}],"description":{"text":"A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.","provenance":"source","from":"CVE.org"},"summary":{"text":"A heap-based buffer overflow in the rsync daemon, shipped in Red Hat Enterprise Linux 10, stems from improper handling of attacker-controlled checksum lengths (s2length), which lets writes occur beyond the fixed-size sum2 buffer when MAX_DIGEST_LEN exceeds SUM_LENGTH (16 bytes). An attacker with network access to the rsync daemon can trigger the out-of-bounds write without authentication, requiring no user interaction and no special configuration beyond the daemon being reachable.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:23Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.72514,"percentile":0.99439,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"references":[{"url":"https://access.redhat.com/errata/RHBA-2025:6470","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12084","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330527","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://kb.cert.org/vuls/id/952657","tags":[]},{"url":"https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj","tags":["exploit"]},{"url":"http://www.openwall.com/lists/oss-security/2025/01/14/6","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250131-0002/","tags":[]},{"url":"https://www.kb.cert.org/vuls/id/952657","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-50580","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-50580","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2025-01-21","earliestUrl":"https://github.com/themirze/cve-2024-12084","repos":[{"name":"themirze/cve-2024-12084","url":"https://github.com/themirze/cve-2024-12084","stars":4,"created":"2025-01-21"},{"name":"rxerium/CVE-2024-12084","url":"https://github.com/rxerium/CVE-2024-12084","stars":1,"created":"2025-01-29"},{"name":"InkeyP/CVE-2024-12084","url":"https://github.com/InkeyP/CVE-2024-12084","stars":1,"created":"2025-11-24"}]},"first":{"date":"2025-01-21","source":"PoC-in-GitHub","url":"https://github.com/themirze/cve-2024-12084"},"provenance":"source"},"exploitRefs":["https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj"],"flow":[],"timeline":[{"date":"2025-01-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-12084","provenance":"source"},{"date":"2025-01-21","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/themirze/cve-2024-12084","provenance":"source"}],"speed":{"daysToPublicExploit":6,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":31.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9944"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}