Skip to content

GHSA-hx7p-3gvv-pqgv

CVE Information

The name-converter contract returns an empty value for an unknown name, but the daemon read an empty line as success and applied atol("") == 0, so an unknown sender name was mapped to uid/gid 0. With fake super = yes the stored file's metadata then became root-owned (0:0).

Fix: treat an empty/non-numeric converter response as a lookup failure, so unknown names fall back to the sender's numeric id.

Test: daemon-namecvt-empty-response.

Credit: Mitchell Benjamin (Revamp Studio).

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)