Kritik CVSS 9.8 PoC var
CVE-2024-12084: Rsync: yığın (heap) taşması
Açıklama (NVD)
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
Özet bilgiler
- Ürün
- Samba Rsync
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %72,51 (yüzdelik 99)
- CWE
- CWE-122
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| samba-rsync | 3.2.7 | 3.2.7 | — |
| samba-rsync | 3.3.0 | 3.3.0 | — |
| almalinux-almalinux | 10.0 | 10.0 | — |
| archlinux-arch-linux | — | — | — |
| gentoo-linux | — | — | — |
| nixos-nixos | — | — | 24.11 |
| nixos-nixos | 24.11 | 24.11 | — |
| novell-suse-linux | — | — | — |
| tritondatacenter-smartos | — | — | 20250123 |
| redhat-enterprise-linux | 10.0 | 10.0 | — |