In January 2025 the rsync project released 3.4.0, a security release for six vulnerabilities found mainly by Google Cloud Vulnerability Research. Debian fixed them for Debian 12 (bookworm) in DSA-5843-1 on 14 January 2025, followed two days later by DSA-5843-2, which repaired a regression with the -H option. The worst of the bugs lets a client run code on an rsync daemon it can read from, and others let a malicious server read or write files on the clients that connect to it.
At a glance
| Item | Details |
|---|---|
| Source package | rsync |
| Fixed versions | 3.2.7-1+deb12u1 (DSA-5843-1), then 3.2.7-1+deb12u2 (DSA-5843-2, hard-link regression) |
| Debian 11 (bullseye) | DLA-4015-1 and DLA-4015-2 at the time; bullseye LTS has since ended |
| Debian 13 (trixie) | Released later with rsync 3.4.1, which already contains these fixes |
| CVEs | CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087, CVE-2024-12088, CVE-2024-12747 |
| Severity | Critical (CVE-2024-12084: CVSS 3.1 9.8 from the CNA, Red Hat) |
| Known exploitation | Not in CISA KEV (30 Oct 2026); CISA's records note public proof-of-concept details |
What the vulnerabilities are
The CERT/CC note VU#952657 explains why this set matters: combined, the heap overflow and the information leak allow a client to execute arbitrary code on a machine running an rsync server, and the client needs only anonymous read access, as on public mirrors. A malicious server, in turn, can read and write arbitrary files of connected clients, for example to steal SSH keys or overwrite ~/.bashrc.
- Against rsync daemons. CVE-2024-12084 (9.8) is a heap buffer overflow caused by attacker-controlled checksum lengths. CVE-2024-12085 (7.5) leaks uninitialised stack memory through checksum comparison, which helps defeat ASLR.
- Against clients. CVE-2024-12086 lets a server leak the contents of arbitrary files from the client. CVE-2024-12087 lets a server write files outside the destination directory through the
--inc-recursivebehaviour, and CVE-2024-12088 bypasses--safe-linkswith nested symbolic links. - Local race. CVE-2024-12747 is a race condition in symbolic-link handling that can leak information and, as Debian notes, may enable privilege escalation.
Are you affected?
Every machine with the rsync package matters, not only servers: backup scripts and deployment tools use the rsync client. Check the version and whether the daemon is running:
dpkg-query -W -f='${Package} ${Version}\n' rsync
apt policy rsync
systemctl is-active rsyncOn Debian 12, anything below 3.2.7-1+deb12u2 lacks these fixes or the regression fix; later bookworm packages include both. An active rsync unit means the daemon is listening (TCP port 873 by default), which is the case CERT/CC describes for remote code execution.
How to update
sudo apt update
sudo apt install --only-upgrade rsyncIf you installed the first fix in January 2025 and saw problems preserving hard links with -H, the second package (3.2.7-1+deb12u2) resolved them, and a normal upgrade brings it in. Debian 11 (bullseye) users received equivalent DLAs, but bullseye left LTS on 31 August 2026 and gets no further rsync fixes; upgrade those systems.
Restart or reboot?
No reboot. Restart the daemon if you run it, so it uses the new binary:
sudo systemctl restart rsyncClient runs pick up the new version the next time they start. Long-running sync jobs that started before the update keep the old code until they finish.
Lower the exposure of rsync daemons
Public anonymous modules were the scenario CERT/CC highlighted. If you do not need the daemon, disable it with sudo systemctl disable --now rsync and use rsync over SSH instead. If you do, restrict port 873 to known addresses at the firewall, require auth users and a secrets file in /etc/rsyncd.conf, and set the module parameter read only to yes where possible.
Sources
- security-tracker.debian.org/tracker/DSA-5843-1
- debian.org/security/2025/dsa-5843
- lists.debian.org/debian-security-announce/2025/msg00004.html
- security-tracker.debian.org/tracker/DSA-5843-2
- lists.debian.org/debian-security-announce/2025/msg00006.html
- security-tracker.debian.org/tracker/DLA-4015-1
- lists.debian.org/debian-lts-announce/2025/01/msg00008.html
- lists.debian.org/debian-lts-announce/2025/01/msg00010.html
- security-tracker.debian.org/tracker/DLA-4015-2
- kb.cert.org/vuls/id/952657
- download.samba.org/pub/rsync/NEWS
- cve.org/CVERecord?id=CVE-2024-12084
- cve.org/CVERecord?id=CVE-2024-12085
- nvd.nist.gov/vuln/detail/CVE-2024-12084
- security-tracker.debian.org/tracker/source-package/rsync
- packages.debian.org/bookworm/amd64/rsync/filelist
- cisa.gov/known-exploited-vulnerabilities-catalog
- debian.org/releases
- manpages.debian.org/bookworm/rsync/rsyncd.conf.5.en.html
Comments
0 total · 0 threads