CVE-2024-12084CWE-122CWE-787

CVE-2024-12084

Critical · published January 15, 2025

Patch now

High probability of exploitation

CVSS calls it critical at 9.8. It sits in the 99.4th percentile for exploit probability.

CVSS v3.1
9.8
EPSS
73%
Percentile
99.4
In the wild
Unconfirmed
What it is

🔥 A heap-based buffer overflow in the rsync daemon opens the door for a sneaky attacker to control memory and wreak havoc! Think of it like a restaurant where the chef has a limited amount of counter space. If a delivery driver brings in a huge shipment without checking the order, the extra ingredients might spill over, messing up everything on the counter! An attacker could exploit this flaw to overwrite critical memory areas, leading to system crashes, unauthorized access, or even remote code execution. Imagine a malicious guest pulling the fire alarm in a packed restaurant — pandemonium could ensue!

Put simply

Think of it like a restaurant where the chef has a limited amount of counter space. If a delivery driver brings in a huge shipment without checking the order, the extra ingredients might spill over, messing up everything on the counter! This vulnerability arises from improper handling of the checksum lengths in the rsync daemon, allowing an attacker to write outside the allocated memory bounds of the sum2 buffer when MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes).

What to do

An attacker could exploit this flaw to overwrite critical memory areas, leading to system crashes, unauthorized access, or even remote code execution. Imagine a malicious guest pulling the fire alarm in a packed restaurant — pandemonium could ensue! Immediately patch rsync to the latest version to resolve this flaw. Review your rsync settings and monitor for any unusual activity that could indicate exploitation attempts. It's always wise to implement strict input validation as an additional safeguard! You’ve got this! By taking action now, you can lock down your systems and keep them safe from potential attacks! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.72514 · 99.4th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-787 · Out-of-bounds Write
Published
2025-01-15T20:15Z
Affected products (10)
ProductVersionsFixed in
samba/rsyncall versions—
samba/rsyncall versions—
almalinux/almalinuxall versions—
archlinux/arch_linuxall versions—
gentoo/linuxall versions—
nixos/nixos< 24.1124.11
nixos/nixosall versions—
novell/suse_linuxall versions—
tritondatacenter/smartos< 2025012320250123
redhat/enterprise_linuxall versions—
References (8)
EPSS history
Timeline
  • 15 JAN 14:16Z
    Rsync: heap buffer overflow in rsync due to improper checksum length handling
    cvelistv5