REDHAT-BUG-2469055: High severity rsync rsync vulnerability
A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed to a time-of-check / time-of-use race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open(), redirecting reads (basis-file disclosure) and writes (file overwrite) outside the module. Under elevated daemon privilege this allows privilege escalation. Default "use chroot = yes" is not exposed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the rsync daemon so that "use chroot" is set to "yes" (the default) instead of "use chroot = no", to prevent exposed rsync daemon modules from allowing privilege escalation via symlinks/races under elevated daemon privilege.
rsync daemon use chroot = yes
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2469055?
The severity of REDHAT-BUG-2469055 is high, with a score of 7.
How do I fix REDHAT-BUG-2469055?
To fix REDHAT-BUG-2469055, reconfigure the rsync daemon to use 'use chroot = yes'.
What is the risk associated with REDHAT-BUG-2469055?
The risk associated with REDHAT-BUG-2469055 is rated at 33.
What component of rsync is affected in REDHAT-BUG-2469055?
The affected component in REDHAT-BUG-2469055 is the rsync daemon configured with 'use chroot = no'.
What type of attack does REDHAT-BUG-2469055 facilitate?
REDHAT-BUG-2469055 facilitates a time-of-check / time-of-use race attack via symlink manipulation.