Rsync: heap buffer overflow in rsync due to improper checksum length handling
Red Hat · Red Hat Enterprise Linux 10
A heap-based buffer overflow in the rsync daemon, shipped in Red Hat Enterprise Linux 10, stems from improper handling of attacker-controlled checksum lengths (s2length), which lets writes occur beyond the fixed-size sum2 buffer when MAX_DIGEST_LEN exceeds SUM_LENGTH (16 bytes). An attacker with network access to the rsync daemon can trigger the out-of-bounds write without authentication, requiring no user interaction and no special configuration beyond the daemon being reachable.
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) appeared 6 days after disclosure. No confirmed exploitation is recorded.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+6 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.