CVE-2024-12084

The problem stems from improper handling of the attacker-controlled checksum length (s2length parameter) in the rsync daemon code. When the value MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH size of 16 bytes, it is possible to write data beyond the boundaries of the sum2 buffer on the heap. An attacker can craft an appropriate request to the rsync daemon, forcing an out-of-bounds write in the allocated memory area.

Successful exploitation of the vulnerability may allow an attacker to gain full control over the system, including remote code execution (RCE) or service disruption. Violation of confidentiality, integrity, and availability of data on the server is possible.

Apply patches available from the vendor according to the references. For Red Hat/AlmaLinux systems, errata RHBA-2025:6470 is available. Additional information is provided in the CERT/CC guide (VU#952657). If an update is not immediately possible, it is recommended to restrict access to the rsync daemon at the firewall level to trusted IP addresses only.

Rsync daemon in Samba Rsync, AlmaLinux, Arch Linux, and Gentoo Linux distributions — specific versions indicated in vendor references