Vulnerability · Published Jan 14, 2025 · Assigned by redhat

CVE-2024-12085Rsync: info leak via uninitialized stack contents

High 7.5

In plain English

A high-severity security flaw in rsync. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 8.6% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)8.6%top 4.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	rsync	3.1.3-20.el8_10	ALSA-2025:0325
AlmaLinux:9	rsync	3.2.3-20.el9_5.1	ALSA-2025:0324
AlmaLinux:8	rsync-daemon	3.1.3-20.el8_10	ALSA-2025:0325
AlmaLinux:9	rsync-daemon	3.2.3-20.el9_5.1	ALSA-2025:0324
Alpine:v3.20	rsync	3.4.0-r0	ALPINE-CVE-2024-12085
Alpine:v3.21	rsync	3.4.0-r0	ALPINE-CVE-2024-12085
Alpine:v3.22	rsync	3.4.0-r0	ALPINE-CVE-2024-12085
Alpine:v3.23	rsync	3.4.0-r0	ALPINE-CVE-2024-12085
Alpine:v3.24	rsync	3.4.0-r0	ALPINE-CVE-2024-12085
Debian:12	rsync	3.2.7-1+deb12u1	DSA-5843-1
Debian:12	rsync	3.2.7-1+deb12u1	DEBIAN-CVE-2024-12085
Debian:13	rsync	3.3.0+ds1-3	DEBIAN-CVE-2024-12085
Debian:14	rsync	3.3.0+ds1-3	DEBIAN-CVE-2024-12085
Rocky Linux:8	rsync	0:3.1.3-20.el8_10	RLSA-2025:0325
Rocky Linux:9	rsync	0:3.2.3-20.el9_5.1	RLSA-2025:0324
Ubuntu:22.04:LTS	rsync	3.2.7-0ubuntu0.22.04.3	USN-7206-1
Ubuntu:22.04:LTS	rsync	3.2.7-0ubuntu0.22.04.3	UBUNTU-CVE-2024-12085
Ubuntu:24.04:LTS	rsync	3.2.7-1ubuntu1.1	UBUNTU-CVE-2024-12085
Ubuntu:24.04:LTS	rsync	3.2.7-1ubuntu1.1	USN-7206-1

Affected products (as reported)

Vendor	Product	Versions
	rsync	0 – through 3.3.0
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	see references
Red Hat	Red Hat OpenShift Container Platform 4.12	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.14	see references
Red Hat	Red Hat OpenShift Container Platform 4.15	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.17	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references

Weakness: CWE-908 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

RHBA-2025:6470 vendor-advisory, x_refsource_REDHAT
RHSA-2024:6122 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0324 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0325 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0637 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0688 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0714 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0774 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0787 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0790 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0849 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0884 vendor-advisory, x_refsource_REDHAT
RHSA-2025:0885 vendor-advisory, x_refsource_REDHAT
RHSA-2025:1120 vendor-advisory, x_refsource_REDHAT
RHSA-2025:1123 vendor-advisory, x_refsource_REDHAT
RHSA-2025:1128 vendor-advisory, x_refsource_REDHAT
RHSA-2025:1225 vendor-advisory, x_refsource_REDHAT
RHSA-2025:1227 vendor-advisory, x_refsource_REDHAT
RHSA-2025:1242 vendor-advisory, x_refsource_REDHAT
RHSA-2025:1451 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21885 vendor-advisory, x_refsource_REDHAT
RHSA-2025:2701 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-12085 vdb-entry, x_refsource_REDHAT
RHBZ#2330539 issue-tracking, x_refsource_REDHAT
https://kb.cert.org/vuls/id/952657
https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj exploit
https://security.netapp.com/advisory/ntap-20250131-0002/
https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html
https://www.kb.cert.org/vuls/id/952657