CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to an out-of-bounds read due to improper handling of checksum blocks, allowing a malicious receiver to exploit this flaw by sending a zero-length block. This can lead to unauthorized memory access, potentially exposing sensitive data from the sender's memory. Organizations using affected versions of rsync should prioritize patching to mitigate the risk of data leakage and ensure secure file synchronization.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.