GHSA-pg7g-xqmr-xpfh on CTRL-OS 26.05

Aliases: GHSA-pg7g-xqmr-xpfh, CVE-2026-70457

Packages: rsync

Status: Plausible

Advisory Information

parse_size_arg() used snprintf()'s return value -- which on truncation is the length the output WOULD have been, not what was written -- as an index into err_buf[]. An oversized --max-size / --min-size / --max-alloc / --bwlimit / --block-size value makes that return value attacker-influenced, producing a two-byte (0x0A, 0x00) write at an attacker-chosen offset in .bss.

These options are forwardable to a daemon by a peer through server_options(), so the value need not come from the local command line. The written bytes are fixed (newline, NUL) and only the offset is controlled, so the demonstrated impact is an out-of-bounds write and corruption of adjacent static state, not useful control of a security-sensitive target.

Fixed by not using the truncation return as an index. A separate integer-overflow defect in the same function -- the size value itself wrapping a signed ssize_t -- is a different issue and is listed under the additional hardening below, not here.

---

Affected: 3.2.3 through 3.4.4 (the unsafe indexing dates from 2020)

Fixed in: 3.5.0

Reporter: Greg Kroah-Hartman (daemon-protocol fuzzing)

Test: daemon-size-arg-overflow

Updates

2026-08-14 16:57 CEST

Metadata changes:

• Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

• Status for package rsync: “New”