Skip to content

GHSA-jhxm-j4mq-3fj4

CVE Information

add_implied_include() builds an implied "/**" filter rule from each transfer argument the client sends, so the remote sender can validate the file list against it. It under-counted a trailing backslash when sizing the buffer for that rule, so the rule was written one byte past a heap allocation. The value that overflows is supplied by the peer.

Demonstrated against a standard network rsync --daemon with a READ-ONLY module: a remote, unauthenticated client sends -r --files-from=<file> with a files-from entry carrying both an interior and a trailing backslash (a\b\), and forward_filesfrom_data() feeds it to add_implied_include() on the daemon side. The per-module parse_arguments() runs with am_server == 0, so trust_sender_args stays 0 and the implied-include path is active.

A read-only module is enough; no write access and no crafted protocol are needed. The write is one byte and its content is constrained, so code execution is not claimed; heap corruption is, and the regression detects it as an ASan heap-buffer-overflow.

Affected: 3.2.5 through 3.4.4 (add_implied_include() entered in 3.2.5)

Fixed in: 3.5.0 (part of the malicious-peer robustness work)

Reporter: Greg Kroah-Hartman (daemon-protocol fuzzing)

Test: exclude-implied-trailing-backslash