VULNERABILITY INTELLIGENCE

CVE-2024-12084

CVSS score9.8 CRITICAL
EPSS probability72.51%
CISA KEVNot currently listed
Published2025-01-15
Last modified2026-10-21
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

Weakness classification

  • secalert@redhat.com: CWE-122
  • nvd@nist.gov: CWE-787

Primary references