CVE-2024-12086
📋 TL;DR
This rsync vulnerability allows a malicious server to read arbitrary files from a client's machine during file transfer operations. Attackers can reconstruct file contents byte-by-byte by sending specially crafted checksums. Anyone using rsync to copy files from client to server is potentially affected.
💻 Affected Systems
- rsync
📦 What is this software?
Almalinux by Almalinux
Almalinux by Almalinux
Almalinux by Almalinux
Arch Linux by Archlinux
Linux by Gentoo
Nixos by Nixos
Rsync by Samba
Smartos by Tritondatacenter
⚠️ Risk & Real-World Impact
Worst Case
Complete exfiltration of sensitive files from client systems including configuration files, credentials, or proprietary data.
Likely Case
Targeted extraction of specific files from rsync clients by compromised or malicious servers.
If Mitigated
Limited impact if rsync is only used between trusted endpoints with proper access controls.
🎯 Exploit Status
Exploitation requires the client to initiate connection to a malicious server. The attack reconstructs files gradually through multiple requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: rsync 3.3.1 and later
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2024-12086
Restart Required: No
Instructions:
1. Update rsync to version 3.3.1 or later using your package manager. 2. For Red Hat/CentOS: 'yum update rsync'. 3. For Debian/Ubuntu: 'apt update && apt upgrade rsync'. 4. For source installation: Download and compile from rsync.samba.org.
🔧 Temporary Workarounds
Use --checksum-choice=xxh128
linuxForce use of xxh128 checksum algorithm which is not vulnerable to this attack
rsync --checksum-choice=xxh128 [other options]
Disable checksum negotiation
allUse --no-checksum to disable checksum verification (reduces performance)
rsync --no-checksum [other options]
🧯 If You Can't Patch
- Only use rsync with trusted servers and verify server authenticity before transfers
- Implement network segmentation to restrict rsync traffic to authorized servers only
🔍 How to Verify
Check if Vulnerable:
Run 'rsync --version' and check if version is below 3.3.1Check Version:
rsync --version | head -1Verify Fix Applied:
Confirm rsync version is 3.3.1 or higher with 'rsync --version | head -1'📡 Detection & Monitoring
Log Indicators:
- Unusual rsync connection patterns to unfamiliar servers
- Multiple rsync sessions with same client to different servers
Network Indicators:
- Rsync traffic to unexpected external IP addresses
- High volume of rsync checksum negotiation packets
SIEM Query:
source="rsync" AND (dest_ip NOT IN [trusted_servers]) | stats count by src_ip, dest_ip🔗 References
- https://access.redhat.com/security/cve/CVE-2024-12086
- https://bugzilla.redhat.com/show_bug.cgi?id=2330577
- https://kb.cert.org/vuls/id/952657
- https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html
- https://security.netapp.com/advisory/ntap-20250131-0002/
- https://www.kb.cert.org/vuls/id/952657
- https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
