CVE-2024-12084

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12084
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
CVSS

No CVSS.

References
Link Resource
https://access.redhat.com/errata/RHBA-2025:6470
https://access.redhat.com/security/cve/CVE-2024-12084 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2330527 Issue Tracking Third Party Advisory
https://kb.cert.org/vuls/id/952657 Third Party Advisory
https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj Exploit Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/01/14/6 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:samba:rsync:3.2.7:-:*:*:*:*:*:*
cpe:2.3:a:samba:rsync:3.3.0:-:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:archlinux:arch_linux:-:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:gentoo:linux:-:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:*
cpe:2.3:o:nixos:nixos:24.11:*:*:*:*:*:*:*

Configuration 6 (hide)

cpe:2.3:o:novell:suse_linux:-:*:*:*:*:*:*:*

Configuration 7 (hide)

cpe:2.3:o:tritondatacenter:smartos:*:*:*:*:*:*:*:*

Configuration 8 (hide)

cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
History

08 Jul 2025, 04:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHBA-2025:6470 -

18 Jun 2025, 16:25

Type Values Removed Values Added
First Time Nixos nixos
Gentoo
Samba rsync
Almalinux
Tritondatacenter
Redhat enterprise Linux
Tritondatacenter smartos
Novell suse Linux
Archlinux arch Linux
Almalinux almalinux
Samba
Nixos
Gentoo linux
Redhat
Archlinux
Novell
CPE cpe:2.3:o:gentoo:linux:-:*:*:*:*:*:*:*
cpe:2.3:o:tritondatacenter:smartos:*:*:*:*:*:*:*:*
cpe:2.3:a:samba:rsync:3.3.0:-:*:*:*:*:*:*
cpe:2.3:o:nixos:nixos:24.11:*:*:*:*:*:*:*
cpe:2.3:o:almalinux:almalinux:10.0:-:*:*:*:*:*:*
cpe:2.3:o:archlinux:arch_linux:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux:-:*:*:*:*:*:*:*
cpe:2.3:a:samba:rsync:3.2.7:-:*:*:*:*:*:*
References () https://access.redhat.com/security/cve/CVE-2024-12084 - () https://access.redhat.com/security/cve/CVE-2024-12084 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2330527 - () https://bugzilla.redhat.com/show_bug.cgi?id=2330527 - Issue Tracking, Third Party Advisory
References () https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj - () https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj - Exploit, Vendor Advisory
References () https://kb.cert.org/vuls/id/952657 - () https://kb.cert.org/vuls/id/952657 - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2025/01/14/6 - () http://www.openwall.com/lists/oss-security/2025/01/14/6 - Mailing List, Third Party Advisory
CWE CWE-787

26 Feb 2025, 14:15

Type Values Removed Values Added
References
  • () https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj -
CWE CWE-122
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : unknown

15 Jan 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-15 15:15

Updated : 2025-07-08 04:15

NVD link : CVE-2024-12084

Mitre link : CVE-2024-12084

JSON object : View

Products Affected

nixos

  • nixos

redhat

  • enterprise_linux

gentoo

  • linux

novell

  • suse_linux

almalinux

  • almalinux

tritondatacenter

  • smartos

archlinux

  • arch_linux

samba

  • rsync
CWE
CWE-787

Out-of-bounds Write