CVE-2024-12085: Samba Rsync Information Disclosure Flaw

CVE-2024-12085 Overview

CVE-2024-12085 is an information disclosure vulnerability discovered in rsync, the widely-used file synchronization and transfer utility. The flaw exists in how rsync compares file checksums, where an attacker can manipulate the checksum length parameter (s2length) to force a comparison between a checksum and uninitialized memory. This enables the attacker to leak one byte of uninitialized stack data at a time, potentially exposing sensitive information from the server's memory.

Critical Impact

Remote attackers can exploit this vulnerability over the network without authentication to leak sensitive stack data from rsync servers, potentially exposing credentials, cryptographic keys, or other confidential information stored in memory.

Affected Products

• Samba rsync (all versions prior to patch)
• Red Hat Enterprise Linux 6.0, 7.0, 8.0, 9.0 and EUS variants
• Red Hat OpenShift Container Platform 4.12 through 4.17
• AlmaLinux 8.0, 9.0, 10.0
• Arch Linux
• Gentoo Linux
• NixOS
• SUSE Linux
• Triton DataCenter SmartOS

Discovery Timeline

• January 14, 2025 - CVE-2024-12085 published to NVD
• November 20, 2025 - Last updated in NVD database

Technical Details for CVE-2024-12085

Vulnerability Analysis

This vulnerability falls under CWE-908 (Use of Uninitialized Resource), representing a memory information disclosure flaw in rsync's checksum comparison logic. The vulnerability enables remote network-based exploitation without requiring authentication or user interaction. An attacker can leverage this flaw to read confidential data from the target system's stack memory.

The attack exploits improper handling of the s2length parameter during checksum comparison operations. When rsync performs file synchronization, it uses checksums to determine which file blocks have changed. By sending specially crafted requests that manipulate the checksum length value, an attacker can cause rsync to compare a legitimate checksum against uninitialized stack memory rather than the intended data.

Root Cause

The root cause stems from inadequate validation of the checksum length parameter (s2length) before performing memory comparisons. When the rsync daemon processes incoming checksum comparison requests, it fails to properly verify that the specified length corresponds to initialized memory regions. This allows an attacker to specify an s2length value that extends the comparison into uninitialized stack space.

The lack of proper bounds checking on the comparison length enables controlled out-of-bounds reads. Since the comparison operation returns different results depending on whether the memory contents match, an attacker can systematically probe and extract individual bytes of uninitialized stack data through repeated requests with varying parameters.

Attack Vector

The attack can be executed remotely over the network against any exposed rsync daemon or server. The exploitation process involves:

1. An attacker connects to a target rsync server or daemon listening on its default port (typically 873)
2. The attacker initiates a file synchronization session and manipulates the checksum comparison parameters
3. By carefully crafting the s2length value, the attacker forces rsync to compare checksums against uninitialized stack memory
4. Based on the comparison results, the attacker can determine the value of individual bytes in the uninitialized memory region
5. Through iterative requests, the attacker can leak multiple bytes of stack data, potentially extracting sensitive information

The vulnerability can be exploited without authentication, making any publicly accessible rsync server a potential target. See the GitHub Security Advisory GHSA-p5pg-x43v-mvqj for additional technical details.

Detection Methods for CVE-2024-12085

Indicators of Compromise

• Unusual volume of rsync connection attempts from single source IP addresses
• Repeated file synchronization requests with abnormal or malformed checksum parameters
• High frequency of short-lived rsync sessions that terminate without completing file transfers
• Unexpected network traffic patterns on rsync ports (default TCP 873)

Detection Strategies

• Monitor rsync daemon logs for connection anomalies and incomplete synchronization sessions
• Implement network-based intrusion detection rules to identify suspicious rsync protocol behavior
• Deploy endpoint detection to alert on abnormal rsync process memory access patterns
• Use packet inspection to detect malformed or suspicious checksum length values in rsync traffic

Monitoring Recommendations

• Enable verbose logging on rsync daemons to capture detailed session information
• Configure alerts for high-volume connection attempts to rsync services from untrusted networks
• Implement rate limiting on rsync connections to slow potential exploitation attempts
• Review rsync access logs regularly for patterns indicative of memory probing attacks

How to Mitigate CVE-2024-12085

Immediate Actions Required

• Update rsync to the latest patched version available from your distribution
• Restrict rsync daemon access to trusted networks using firewall rules
• Disable anonymous rsync access if not required for operations
• Consider using rsync over SSH instead of running the rsync daemon directly

Patch Information

Multiple vendors have released security patches to address this vulnerability. Red Hat has issued security errata including RHSA-2025:0324 and RHSA-2025:0325 for affected Enterprise Linux versions. Additional errata are available for OpenShift Container Platform and other RHEL variants.

Debian has released patches as documented in the Debian LTS Announcement. NetApp customers should refer to Security Advisory NTAP-20250131-0002. Consult the CERT Vulnerability Report #952657 for comprehensive vendor patch information.

Workarounds

• Restrict rsync daemon access to localhost or trusted internal networks only using firewall rules
• Tunnel all rsync traffic through SSH rather than exposing the rsync daemon directly
• Implement network segmentation to isolate rsync servers from untrusted network zones
• Disable the rsync daemon service if file synchronization can be achieved through alternative methods

# Restrict rsync daemon to trusted networks using iptables
iptables -A INPUT -p tcp --dport 873 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 873 -j DROP

# Use rsync over SSH instead of daemon mode
rsync -avz -e ssh /source/path user@remote:/destination/path

# Disable rsync daemon service
systemctl stop rsyncd
systemctl disable rsyncd