CVE-2024-12085

Published Jan 14, 2025

Last updated 16 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-12085 is an information leakage vulnerability in the rsync utility. It occurs when rsync compares file checksums due to improper initialization of memory. An attacker can manipulate the checksum length, leading to a comparison between a checksum and uninitialized memory. This allows them to leak one byte of uninitialized stack data at a time. The vulnerability arises from the incorrect initialization of the “sum2” variable. Rsync is a widely used utility for file synchronization. It is commonly used for backups, mirroring data between servers, and distributing software updates. The vulnerability affects various operating systems and distributions. A patch has been released to address this vulnerability, and users are urged to update their rsync installations to the latest version. As a temporary mitigation, rsync can be compiled with the “-ftrivial-auto-var-init=zero” option. This sets the initial value of the “sum2” variable to zero.

Description: A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
Source: secalert@redhat.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

secalert@redhat.com: CWE-119

Hype score: Not currently trending

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References