CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to a signed integer overflow in the I/O timeout implementation, allowing attackers to inject crafted MSG_IO_TIMEOUT messages with non-positive values. This exploitation can disable connection timeouts, resulting in resource exhaustion as idle connections monopolize daemon slots. System administrators and organizations using affected rsync versions should prioritize patching to mitigate potential denial-of-service risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.