CVE-2024-12085
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A flaw in rsync allows an attacker to manipulate the checksum length (s2length) during file checksum comparison, causing a comparison with uninitialized memory and leaking one byte of stack data at a time.
Risk Assessment
The risk involves potential leakage of sensitive data from stack memory, which could lead to disclosure of confidential information or further attack escalation.
Recommendation
Immediately update rsync to the latest patched version and monitor systems for unusual file transfer activity.
Original NVD description (English source)
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.