Skip to content

GHSA-wj7w-vh23-mm44 on CTRL-OS 26.05

Aliases: GHSA-wj7w-vh23-mm44, CVE-2026-53793

Packages: rsync

Status: Plausible

Advisory Information

With use chroot = yes and a /./ inner module, the kernel chroot confines only the outer path, so a symlinked parent component inside the inner module reached a sibling outside it. This affected the generator's basis stat, the receiver write/finish path, the module chdir, and -- found during review -- the receiver's delta-basis open: a peer-forged fnamecmp_type could make the receiver open an out-of-inner-module file as the delta basis even after the generator-side stat was confined.

Fix: engage the secure resolver for the inner-module case across all of those paths, including the receiver delta-basis open.

Tests: chroot-alt-dest-inner-module, chroot-basis-forge-inner-module, chroot-copy-dest-inner-module, chroot-link-dest-inner-module, chroot-receiver-write-inner-module, chroot-special-inner-module.

Additional variant (same peer-forged delta-basis class, client side): a malicious server likewise controls the basis name (xname) the pull client uses under --link-dest / --copy-dest / --compare-dest / --fuzzy. A server-supplied xname carrying traversal components made the client open an out-of-tree file as the delta basis, disclosing its contents back to the server (transfer shaping / information disclosure) -- the same peer-controlled delta-basis path, on the client and outside any chroot. Fix: sanitize the peer-supplied basis xname on the client. Test: basis-xname-traversal. Credit (variant): Z3R0S! (z3r0s6), independent reporter.

Note: the macOS timestamp tier is part of this boundary too. The setattrlist mtime/atime helper now uses the hardened gate (secure_relpath_active()) and routes through the race-safe utimensat tier, so the inner-module times escape is closed. macOS crtime (--crtimes) has no race-safe primitive (no setattrlistat for ATTR_CMN_CRTIME); per the ACL policy it stays functional and the parent-symlink crtime race is an accepted, documented residual (SECURITY.md), refusable via refuse options = crtimes.

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”