Loading vulnerability…
Rsync Symbolic-Link Race Condition
CVE-2024-12747 is a time-of-check/time-of-use race condition in rsync symbolic-link handling. Although rsync normally skips symbolic links, an attacker who replaces a regular file with a symbolic link during the relevant processing window can bypass that default behavior and cause rsync to traverse the link. The issue may expose data accessible to the rsync process and can potentially support privilege escalation where that process has elevated access.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive information reachable through an improperly traversed symbolic link. Depending on the privileges under which rsync runs, the disclosure may potentially lead to privilege escalation.
If you can’t patch tonight, do this now.
Until patched packages can be deployed, prevent untrusted users or processes from modifying files in rsync source or destination trees during synchronization. Run rsync with the minimum necessary privileges and restrict access to rsync services and associated file shares.
Patch, then assume compromise.
Update rsync to a vendor-provided patched release. Upstream guidance in the available information recommends upgrading to rsync 3.4.0 or later; use the patched package supplied by the operating-system or product vendor where applicable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.