CVE-2024-12088
📋 TL;DR
A path traversal vulnerability in rsync's --safe-links option allows attackers to write files outside intended directories when the client fails to properly verify nested symbolic links from the server. This affects rsync clients using the --safe-links option with untrusted servers. Users syncing from malicious or compromised servers are at risk.
💻 Affected Systems
- rsync
📦 What is this software?
Almalinux by Almalinux
Almalinux by Almalinux
Almalinux by Almalinux
Arch Linux by Archlinux
Discovery by Redhat
Enterprise Linux For Ibm Z Systems by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems →
Enterprise Linux For Ibm Z Systems by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems →
Enterprise Linux For Ibm Z Systems Eus by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems Eus →
Enterprise Linux For Power Little Endian by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian →
Enterprise Linux For Power Little Endian by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian →
Enterprise Linux For Power Little Endian Eus by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian Eus →
Enterprise Linux Update Services For Sap Solutions by Redhat
View all CVEs affecting Enterprise Linux Update Services For Sap Solutions →
Linux by Gentoo
Nixos by Nixos
Rsync by Samba
Smartos by Tritondatacenter
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file write leading to remote code execution, data theft, or system destruction.
Likely Case
Unauthorized file writes to sensitive locations, potentially enabling privilege escalation or data manipulation.
If Mitigated
Limited impact if proper access controls, network segmentation, and trusted server policies are enforced.
🎯 Exploit Status
Exploitation requires the client to initiate a sync with a malicious server; no authentication bypass needed on client side.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: rsync 3.3.2 and later
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2024-12088
Restart Required: No
Instructions:
1. Update rsync to version 3.3.2 or later using your package manager. 2. For Red Hat systems, apply relevant errata: RHSA-2025:2600, RHSA-2025:7050, or RHSA-2025:8385. 3. Verify the update with 'rsync --version'.
🔧 Temporary Workarounds
Disable --safe-links
allRemove --safe-links option from rsync commands if not required, though this reduces security against symlink attacks.
Replace 'rsync --safe-links ...' with 'rsync ...' in scripts/commands
Use trusted servers only
allRestrict rsync client connections to verified, trusted servers to prevent exploitation.
🧯 If You Can't Patch
- Implement strict network controls to allow rsync only to trusted internal servers.
- Monitor rsync logs for unusual file write patterns and audit server integrity regularly.
🔍 How to Verify
Check if Vulnerable:
Run 'rsync --version' and check if version is below 3.3.2; also verify if --safe-links is used in configurations.Check Version:
rsync --version | head -1Verify Fix Applied:
Run 'rsync --version' and confirm version is 3.3.2 or higher; test with a safe symlink scenario if possible.📡 Detection & Monitoring
Log Indicators:
- Unusual file write patterns in rsync logs, especially outside expected directories
- Errors related to symlink verification in rsync client logs
Network Indicators:
- Unexpected rsync connections to unknown or external servers
- Anomalous data transfers via rsync protocol
SIEM Query:
source="rsync" AND (event="write" OR event="symlink") AND path NOT CONTAINS "/expected/directory/"🔗 References
- https://access.redhat.com/errata/RHSA-2025:2600
- https://access.redhat.com/errata/RHSA-2025:7050
- https://access.redhat.com/errata/RHSA-2025:8385
- https://access.redhat.com/security/cve/CVE-2024-12088
- https://bugzilla.redhat.com/show_bug.cgi?id=2330676
- https://kb.cert.org/vuls/id/952657
- https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html
- https://security.netapp.com/advisory/ntap-20250131-0002/
- https://www.kb.cert.org/vuls/id/952657
- https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
