Skip to content

GHSA-hrwq-ccf7-rw5m

CVE Information

An unauthenticated peer can connect to an rsync daemon, complete the @RSYNCD greeting, and then stall indefinitely -- either by sending a line with no terminator, or by trickling NUL-terminated arguments into read_args() one byte at a time. The forked per-connection child waits forever.

The timeout module parameter did not mitigate this: it defaults to 0 (disabled), and even when an administrator sets it, set_io_timeout() ran AFTER the read_args() calls that needed covering.

The two stall forms differ in reach. A stall BEFORE module selection pins a process and a file descriptor but claims no module slot. A stall AFTER module selection -- the argument trickle, since both read_args() calls come later than claim_connection() -- holds a max connections slot, so repeating it in parallel makes the module unavailable to legitimate clients. No authentication is required, and the attack works against an anonymous module.

Fixed by arming a separate handshake deadline, with a non-zero built-in default, before the greeting and spanning both read_args() calls. The daemon's early-protocol argument count is bounded by the same work, so an unauthenticated peer can neither stall the handshake nor grow it without limit.

Affected: 2.0.0 through 3.4.4

Fixed in: 3.5.0

Reporters: Chamal De Silva (connection holding); Michal Ruprich, Red Hat QE (the read_args() argument-trickle shape). Reported independently.

Test: daemon-handshake-timeout