Rsync: Checksum Length Manipulation Enables Stack Data Leak
CVE-2024-12085 Published on January 14, 2025

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2024-12085 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Use of Uninitialized Resource

The software uses or accesses a resource that has not been initialized. When a resource has not been properly initialized, the software may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the software.


Products Associated with CVE-2024-12085

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-12085 are published in these products:

Canonical Ubuntu Linux
 
Samba Rsync
 
Red Hat Enterprise Linux Server
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Enterprise Linux Server Aus
 
Red Hat Enterprise Linux Server Tus
 
Red Hat Openshift Container Platform
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux Power Little Endian
 
Red Hat Enterprise Linux Server Power Little Endian Update Services Sap Solutions
 
Red Hat Enterprise Linux For Arm 64
 
Red Hat Enterprise Linux Ibm Z Systems
 
Red Hat Enterprise Linux Arm 64 Eus
 
Red Hat Enterprise Linux Ibm Z Systems Eus
 
Red Hat Enterprise Linux Power Little Endian Eus
 
Red Hat Enterprise Linux Update Services Sap Solutions
 
Red Hat Openshift
 
Almalinux
 
Archlinux Arch Linux
 
Gentoo Linux
 
Nixos
 
Suse Linux
 
Tritondatacenter Smartos
 
Red Hat Rhel Els
 
Red Hat Rhel Aus
 
Red Hat Rhel Tus
 
Red Hat Rhel E4s
 
Red Hat Rhel Eus
 
Red Hat Logging
 
Red Hat Openshift Compliance Operator
 

Exploit Probability

EPSS
13.04%
Percentile
93.82%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.