InfoSec Signals™
Sign InStart Free
Back to CVE records
High 7.5Published Jan 14, 2025

CVE-2024-12085Rsync: info leak via uninitialized stack contents

Updated under an hour ago ()

Does this affect you?

It affects Red Hat Enterprise Linux 10 and 28 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

CVSS
7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE)
CWE-908
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
redhat
NVD analysis
Modified
Record last updated
Oct 13, 2026
First seen by InfoSec Signals
Oct 13, 2026

Affected products

Affected products
from 0:3.4.1-2.el10 not affected
CNA record
from 0:3.0.6-12.el6_10.1 not affected
CNA record
from 0:3.1.3-7.el8_2.3 not affected
CNA record
from 0:3.1.3-12.el8_4.3 not affected
CNA record
from 0:3.1.3-12.el8_4.3 not affected
CNA record
from 0:3.1.3-20.el8_8.1 not affected
CNA record
from 412.86.202502100314-0 not affected
CNA record
from v5.8.17-22 not affected
CNA record
Red Hat Compliance Operator 1
redhat:openshift_compliance_operator
from 1.8.0 not affected
CNA record
samba rsync
samba:rsync
before 3.3.0
NVD
redhat openshift
redhat:openshift
5.0
NVD
redhat openshift_container_platform
redhat:openshift_container_platform
4.12; 4.13; 4.14; 4.15; 4.16; 4.17
NVD
redhat enterprise_linux
redhat:enterprise_linux
8.0; 9.0
NVD
redhat enterprise_linux_eus
redhat:enterprise_linux_eus
8.8; 9.2; 9.4; 9.6
NVD
redhat enterprise_linux_for_arm_64
redhat:enterprise_linux_for_arm_64
8.0_aarch64; 9.0_aarch64; 9.2_aarch64
NVD
redhat enterprise_linux_for_arm_64_eus
redhat:enterprise_linux_for_arm_64_eus
8.8_aarch64; 9.4_aarch64; 9.6_aarch64
NVD
redhat enterprise_linux_for_ibm_z_systems
redhat:enterprise_linux_for_ibm_z_systems
8.0_s390x; 9.0_s390x; 9.2_s390x
NVD
redhat enterprise_linux_for_ibm_z_systems_eus
redhat:enterprise_linux_for_ibm_z_systems_eus
8.8_s390x; 9.4_s390x; 9.6_s390x
NVD
redhat enterprise_linux_for_power_little_endian
redhat:enterprise_linux_for_power_little_endian
8.0_ppc64le; 8.8_ppc64le; 9.0_ppc64le; 9.2_ppc64le
NVD
redhat enterprise_linux_for_power_little_endian_eus
redhat:enterprise_linux_for_power_little_endian_eus
9.4_ppc64le; 9.6_ppc64le
NVD
redhat enterprise_linux_server
redhat:enterprise_linux_server
6.0; 7.0
NVD
redhat enterprise_linux_server_aus
redhat:enterprise_linux_server_aus
8.2; 8.4; 8.6; 9.2; 9.4; 9.6
NVD
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
8.4_ppc64le; 8.6_ppc64le; 8.8_ppc64le; 9.0_ppc64le; 9.2_ppc64le; 9.4_ppc64le; 9.6_ppc64le
NVD
redhat enterprise_linux_server_tus
redhat:enterprise_linux_server_tus
8.4; 8.6; 8.8
NVD
redhat enterprise_linux_update_services_for_sap_solutions
redhat:enterprise_linux_update_services_for_sap_solutions
8.4; 8.6; 9.0; 9.2; 9.6
NVD
almalinux almalinux
almalinux:almalinux
8.0; 9.0; 10.0
NVD
archlinux arch_linux
archlinux:arch_linux
all versions
NVD
gentoo linux
gentoo:linux
all versions
NVD
nixos nixos
nixos:nixos
before 24.11
NVD
suse suse_linux
suse:suse_linux
all versions
NVD
tritondatacenter smartos
tritondatacenter:smartos
before 20250123
NVD

References

  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat, third-party-advisory
  • vdb-entry, x-refsource-redhat, third-party-advisory
  • issue-tracking, x-refsource-redhat, third-party-advisory
  • third-party-advisory

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.