Skip to content

GHSA-g9f4-7q66-9582

CVE Information

--log-file, --write-batch/--read-batch, and the daemon ancillary opens (motd, lock file, early-input file, --config rsyncd.conf) opened their paths without symlink confinement. A planted symlink at the path (or a parent component, the /tmp/<dir>/ case that a leaf-only O_NOFOLLOW does not defend) redirects the write: e.g. appending the rsync log to /root/.ssh/authorized_keys for privilege escalation, or truncating an arbitrary file via --write-batch. For --read-batch a planted symlink/FIFO/device also let an attacker feed chosen bytes to the protocol parser.

Fix: the same trusted-owner path walk; plus an S_ISREG check on the opened --read-batch file.

Tests: log-file-symlink, batch-file-symlink, daemon-config-symlink.

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)