CVE-2024-12085
Published: 14 January 2025
Description
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
Security Summary
CVE-2024-12085 is a vulnerability in rsync that arises during file checksum comparisons. The flaw enables an attacker to manipulate the checksum length parameter (s2length), causing rsync to compare a provided checksum against uninitialized memory. This results in the disclosure of one byte of uninitialized stack data per operation. The issue is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-908 (Use of Uninitialized Resource). It was published on 2025-01-14.
A remote, unauthenticated attacker can exploit this vulnerability with low attack complexity and no user interaction. By sending crafted rsync traffic that triggers checksum comparisons, the attacker can iteratively leak uninitialized stack bytes, enabling gradual information disclosure from the target's memory.
Red Hat has issued multiple errata addressing this flaw, including RHBA-2025:6470, RHSA-2025:0324, RHSA-2025:0325, RHSA-2025:0637, and RHSA-2025:0688. Security practitioners running affected rsync versions on Red Hat systems should apply these updates for mitigation.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability in rsync enables an attacker to remotely leak uninitialized stack memory one byte at a time by manipulating the checksum length (s2length) during file checksum comparisons, facilitating OS Credential Dumping (T1003) from the rsync process memory.