Re: [Buildroot] [PATCH] package/rsync: security bump to version 3.4.0

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > Fixes the following vulnerabilities:
 > CVE-2024-12084: Heap Buffer Overflow in Rsync due to Improper Checksum
 > Length Handling

 > Description: A heap-based buffer overflow flaw was found in the rsync
 > daemon. This issue is due to improper handling of attacker-controlled
 > checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the
 > fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the
 > sum2 buffer.

 > CVE-2024-12085: Info Leak via Uninitialized Stack Contents

 > Description: A flaw was found in the rsync daemon which could be triggered
 > when rsync compares file checksums. This flaw allows an attacker to
 > manipulate the checksum length (s2length) to cause a comparison between a
 > checksum and uninitialized memory and leak one byte of uninitialized stack
 > data at a time.

 > CVE-2024-12086: Rsync Server Leaks Arbitrary Client Files

 > Description: A flaw was found in rsync. It could allow a server to
 > enumerate the contents of an arbitrary file from the client's machine. This
 > issue occurs when files are being copied from a client to a server. During
 > this process, the rsync server will send checksums of local data to the
 > client to compare with in order to determine what data needs to be sent to
 > the server. By sending specially constructed checksum values for arbitrary
 > files, an attacker may be able to reconstruct the data of those files
 > byte-by-byte based on the responses from the client.

 > CVE-2024-12087: Path Traversal Vulnerability in Rsync

 > Description: A path traversal vulnerability exists in rsync. It stems from
 > behavior enabled by the `--inc-recursive` option, a default-enabled option
 > for many client options and can be enabled by the server even if not
 > explicitly enabled by the client. When using the `--inc-recursive` option,
 > a lack of proper symlink verification coupled with deduplication checks
 > occurring on a per-file-list basis could allow a server to write files
 > outside of the client's intended destination directory. A malicious server
 > could write malicious files to arbitrary locations named after valid
 > directories/paths on the client.

 > CVE-2024-12088: --safe-links Option Bypass Leads to Path Traversal

 > Description: A flaw was found in rsync. When using the `--safe-links`
 > option, rsync fails to properly verify if a symbolic link destination
 > contains another symbolic link within it. This results in a path traversal
 > vulnerability, which may lead to arbitrary file write outside the desired
 > directory.

 > CVE-2024-12747: Race Condition in Rsync Handling Symbolic Links

 > Description: A flaw was found in rsync. This vulnerability arises from a
 > race condition during rsync's handling of symbolic links. Rsync's default
 > behavior when encountering symbolic links is to skip them. If an attacker
 > replaced a regular file with a symbolic link at the right time, it was
 > possible to bypass the default behavior and traverse symbolic links.
 > Depending on the privileges of the rsync process, an attacker could leak
 > sensitive information, potentially leading to privilege escalation.

 > For more details, see the advisory:
 > https://www.openwall.com/lists/oss-security/2025/01/14/3

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed to 2024.02.x and 2024.11.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot