CVE-2024-12084

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12084
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2024-12084
https://bugzilla.redhat.com/show_bug.cgi?id=2330527
https://kb.cert.org/vuls/id/952657
http://www.openwall.com/lists/oss-security/2025/01/14/6
https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
Configurations

No configuration.

History

26 Feb 2025, 14:15

Type Values Removed Values Added
Summary
  • (es) Se encontró un fallo de desbordamiento de búfer basado en montón en rsync daemon. Este problema se debe a una gestión inadecuada de las longitudes de suma de comprobación controladas por el atacante (s2length) en el código. Cuando MAX_DIGEST_LEN excede el valor fijo SUM_LENGTH (16 bytes), un atacante puede escribir fuera de los límites en el búfer de sum2.
References
  • () https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj -

15 Jan 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-15 15:15

Updated : 2025-02-26 14:15

NVD link : CVE-2024-12084

Mitre link : CVE-2024-12084

CVE.ORG link : CVE-2024-12084

JSON object : View

Products Affected

No product.

CWE
CWE-122

Heap-based Buffer Overflow