Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recv_files() lets a malicious rsync server (or any peer acting in the sender role) deterministically crash any rsync client that pulls from it. The trigger is fully wire-protocol-level, requires no special options on the victim, and works for both rsync:// URLs and remote-shell pulls; since inc_recurse is the protocol-30+ default, any client doing a normal recursive pull against an attacker-controlled URL is exposed. A malicious server sets CF_INC_RECURSE, sends a flist whose first sorted entry is not the leading "." directory (causing parent_ndx to be set to -1), then sends a transfer record with ndx = 0 and an iflag omitting ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference the result in f_name(). The impact is crash-only: the out-of-bounds read lands in glibc mmap chunk metadata and dereferences to an unmapped low address, producing a SEGV that cannot be leveraged into an exploit (confirmed on glibc x86-64 Linux; non-glibc allocators not audited). This issue is fixed in version 3.4.3.
Get an AI-powered plain-language explanation of this vulnerability and remediation steps.
Login to generate AI explanationCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
1 reference(s) from NVD