Skip to content

GHSA-hrwq-ccf7-rw5m on CTRL-OS 26.05

Aliases: GHSA-hrwq-ccf7-rw5m, CVE-2026-70464

Packages: rsync

Status: Plausible

Advisory Information

An unauthenticated peer can connect to an rsync daemon, complete the @RSYNCD greeting, and then stall indefinitely -- either by sending a line with no terminator, or by trickling NUL-terminated arguments into read_args() one byte at a time. The forked per-connection child waits forever.

The timeout module parameter did not mitigate this: it defaults to 0 (disabled), and even when an administrator sets it, set_io_timeout() ran AFTER the read_args() calls that needed covering.

The two stall forms differ in reach. A stall BEFORE module selection pins a process and a file descriptor but claims no module slot. A stall AFTER module selection -- the argument trickle, since both read_args() calls come later than claim_connection() -- holds a max connections slot, so repeating it in parallel makes the module unavailable to legitimate clients. No authentication is required, and the attack works against an anonymous module.

Fixed by arming a separate handshake deadline, with a non-zero built-in default, before the greeting and spanning both read_args() calls. The daemon's early-protocol argument count is bounded by the same work, so an unauthenticated peer can neither stall the handshake nor grow it without limit.

Affected: 2.0.0 through 3.4.4

Fixed in: 3.5.0

Reporters: Chamal De Silva (connection holding); Michal Ruprich, Red Hat QE (the read_args() argument-trickle shape). Reported independently.

Test: daemon-handshake-timeout

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”