Riskcovery

CVE-2024-12747

Rsync: race condition in rsync handling symbolic links

State
Published
Severity
5.6 Medium
Published
Jan 14, 2025
Updated
Oct 21, 2026
Reserved
Dec 18, 2024

Read the record on cve.org

Description

A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.

Scores

CVSSScoreVectorSource
3.15.6 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:Nredhat

Weaknesses

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

ProductVersions
rsync
  • 3.3.0 and earlierAffected
Red Hat Enterprise Linux 10Red Hat
  • 0:3.4.1-2.el10 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:3.1.3-21.el8_10 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:3.2.5-3.el9 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:3.2.5-3.el9 and laterNot affected
Red Hat Discovery 1.14Red Hat
  • 1.14.2-1748467619 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
    Red Hat Enterprise Linux 7Red Hat
      Red Hat OpenShift Container Platform 4Red Hat

        References

        Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.