Debian Patches
Status for rsync/3.4.1+ds1-5+deb13u3
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| disable_reconfigure_req.diff | Remove need to run reconfigure target =================================================================== |
Samuel Henrique <samueloph@debian.org> | not-needed | 2024-04-12 | ||
| skip_devices_test_non_linux.patch | Skip "devices" test as it fails on kfreebsd and hurd Error log: sent 160 bytes received 117 bytes 554.00 bytes/sec total size is 0 speedup is 0.00 check how the directory listings compare with diff: + + /<<PKGBUILDDIR>>/rsynctee -aii /<<PKGBUILDDIR>>/testtmp/devices/rsync.out --link-dest=/<<PKGBUILDDIR>>/testtmp/devices/to /<<PKGBUILDDIR>>/testtmp/devices/from/ /<<PKGBUILDDIR>>/testtmp/devices/chk/ rsync: failed to hard-link /<<PKGBUILDDIR>>/testtmp/devices/to/fifo with fifo: Invalid cross-device link (1073741842) cd ./ hD block hD block2 hD block3 hD block3.5 hD char hD char2 hD char3 cSc........ fifo rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1207) [sender=3.1.3] + cat + diff -u /<<PKGBUILDDIR>>/testtmp/devices/rsync.chk /<<PKGBUILDDIR>>/testtmp/devices/rsync.out /--- /<<PKGBUILDDIR>>/testtmp/devices/rsync.chk 2019-10-15 01:26:43.000000000 +0000 /+++ /<<PKGBUILDDIR>>/testtmp/devices/rsync.out 2019-10-15 01:26:43.000000000 +0000 @@ -6,4 +6,4 @@ hD char hD char2 hD char3 -hS fifo +cSc........ fifo + test_fail test 5 failed + echo test 5 failed test 5 failed + exit 1 /bin/fakeauth: Error 1 for child 7541 /bin/settrans: Error 1 for child 7540 ----- devices log ends FAIL devices |
Samuel Henrique <samueloph@debian.org> | no | 2024-04-12 | ||
| env_shebang.patch | =?utf-8?q?Removes_usage_of_env_on_shebangs_as_per_Debian_Policy_?= =?utf-8?q?=C2=A7_10=2E4?= | Samuel Henrique <samueloph@debian.org> | not-needed | 2024-04-12 | ||
| fix_rrsync_man_generation.patch | Fix manpage installation for rrsync Otherwise we would get "ERROR: support/rrsync.1 cannot be created." I'm not confident this is the best approach on solving this issue, but I know this works with no regressions. This patch needs to be reviewed before being submitted to upstream. =================================================================== |
Samuel Henrique <samueloph@debian.org> | no | 2024-04-12 | ||
| fix-flaky-hardlinks-test.patch | Fix flaky hardlinks test The test was added in dc34990, it turns out that it's flaky. It failed once on the Debian build infra, cf. [1]. The problem is that the command `rsync -aH '$fromdir/sym' '$todir'` updates the mod time of `$todir`, so there might be a diff between the output of `rsync_ls_lR $fromdir` and `rsync_ls_lR $todir`, if ever rsync runs 1 second (or more) after the directories were created. To clarify: it's easy to make the test fails 100% of the times with this change: ``` makepath "$fromdir/sym" "$todir" +sleep 5 checkit "$RSYNC -aH '$fromdir/sym' '$todir'" "$fromdir" "$todir" ``` With the fix proposed here, we don't use `checkit` anymore, instead we just run the rsync command, then a simple `diff` to compare the two directories. This is exactly what the other `-H` test just above does. In case there's some doubts, `diff` fails if `sym` is missing: ``` $ mkdir -p foo/sym bar $ diff foo bar || echo KO! Only in foo: sym KO! ``` I tested that, after this commit, the test still catches the `-H` regression in rsync 3.4.0. [1]: https://buildd.debian.org/status/fetch.php?pkg=rsync&arch=ppc64el&ver=3.4.1%2Bds1-1&stamp=1741147156&raw=0 |
Arnaud Rebillout <arnaudr@kali.org> | yes | 2025-03-06 | ||
| 2026-05-20/0001-bool-is-a-keyword-in-C23.patch | [PATCH 01/38] bool is a keyword in C23 | Michal Ruprich <mruprich@redhat.com> | no | 2025-01-17 | ||
| 2026-05-20/0002-syscall-fix-a-Y2038-bug-by-replacing-Int32x32To64-wi.patch | [PATCH 02/38] syscall: fix a Y2038 bug by replacing Int32x32To64 with multiplication Int32x32To64 macro internally truncates the arguments to int32, while time_t is 64-bit on most/all modern platforms. Therefore, usage of this macro creates a Year 2038 bug. |
Silent <zdanio95@gmail.com> | no | 2025-01-13 | ||
| 2026-05-20/0003-options.c-Fix-segv-if-poptGetContext-returns-NULL.patch | [PATCH 03/38] options.c: Fix segv if poptGetContext returns NULL If poptGetContext returns NULL, perhaps due to OOM, a NULL pointer is passed into poptReadDefaultConfig() which in turns SEGVs when trying to dereference it. This was found using https://github.com/sahlberg/malloc-fail-tester.git $ ./test_malloc_failure.sh rsync -Pav crash crosh |
Ronnie Sahlberg <ronniesahlberg@gmail.com> | no | 2025-01-30 | ||
| 2026-05-20/0004-Using-a-correct-time-in-log-file.patch | [PATCH 04/38] Using a correct time in log file | Michal Ruprich <mruprich@redhat.com> | no | 2025-01-31 | ||
| 2026-05-20/0005-configure.ac-check-for-xattr-support-both-in-libc-an.patch | [PATCH 05/38] configure.ac: check for xattr support both in libc and in -lattr In 2015, the attr/xattr.h header was fully removed from upstream attr. In 2020, rsync started preferring the standard header, if it exists: https://github.com/RsyncProject/rsync/pull/22 But the fix was incomplete. We still looked for the getxattr function in -lattr, and used it if -lattr exists. This was the case even if the system libc was sufficient to provide the needed functions. Result: overlinking to -lattr, if it happened to be installed for any other reason. ``` checking whether to support extended attributes... Using Linux xattrs checking for getxattr in -lattr... yes ``` Instead, use a different autoconf macro that first checks if the function is available for use without any libraries (e.g. it is in libc). Result: ``` checking whether to support extended attributes... Using Linux xattrs checking for library containing getxattr... none required ``` |
Eli Schwartz <eschwartz@gentoo.org> | no | 2025-04-22 | ||
| 2026-05-20/0006-util-fixed-issue-in-clean_fname.patch | [PATCH 06/38] util: fixed issue in clean_fname() fixes buffer underflow (not exploitable) in clean_fname |
Andrew Tridgell <andrew@tridgell.net> | no | 2025-08-23 | ||
| 2026-05-20/0007-testsuite-added-clean-fname-underflow-test.patch | [PATCH 07/38] testsuite: added clean-fname-underflow test | Andrew Tridgell <andrew@tridgell.net> | no | 2025-08-23 | ||
| 2026-05-20/0008-fixed-an-invalid-access-to-files-array.patch | [PATCH 08/38] fixed an invalid access to files array this was found by Calum Hutton from Rapid7. It is a real bug, but analysis shows it can't be leverged into an exploit. Worth fixing though. Many thanks to Calum and Rapid7 for finding and reporting this |
Andrew Tridgell <andrew@tridgell.net> | no | 2025-08-23 | ||
| 2026-05-20/0009-fix-uninitialized-buf1-in-get_checksum2-MD4-path.patch | [PATCH 09/38] fix uninitialized buf1 in get_checksum2() MD4 path The static buf1 pointer was only allocated when len > len1, but on first call with len == 0, this condition is false (0 > 0), leaving buf1 NULL when passed to memcpy(). Fixes #673 |
Andrew Tridgell <andrew@tridgell.net> | no | 2025-12-30 | ||
| 2026-05-20/0010-reject-negative-token-values-in-compressed-stream-re.patch | [PATCH 10/38] reject negative token values in compressed stream receivers Validate that token numbers read from compressed streams are non-negative. A negative token value would cause the return value of recv_*_token() to become positive, which callers interpret as literal data length, but no data pointer is set on this code path. While this only causes the receiver to crash (which is process-isolated and only affects the attacker's own connection), it's still undefined behavior. |
Andrew Tridgell <andrew@tridgell.net> | no | 2025-12-30 | ||
| 2026-05-20/0011-acl-fixed-ACL-ID-mapping-for-non-root.patch | [PATCH 11/38] acl: fixed ACL ID mapping for non-root closes issue #618 |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-01-19 | ||
| 2026-05-20/0012-fix-uninitialized-mul_one-in-AVX2-checksum-and-add-S.patch | [PATCH 12/38] fix uninitialized mul_one in AVX2 checksum and add SIMD checksum test The AVX2 get_checksum1_avx2_64() read mul_one before initializing it, which is undefined behavior. Replace the cmpeq/abs trick with _mm256_set1_epi8(1) to match the SSSE3 and SSE2 versions. Add a TEST_SIMD_CHECKSUM1 test mode that verifies all SIMD paths (SSE2, SSSE3, AVX2, and the full dispatch chain) produce identical results to the C reference, across multiple buffer sizes with both aligned and unaligned buffers. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-03-01 | ||
| 2026-05-20/0013-Fix-glibc-2.43-constness-warnings.patch | [PATCH 13/38] Fix glibc-2.43 constness warnings Glibc 2.43 added C23 const-preserving overloads to various string functions, which change the return type depending on the constness of the argument(s). Currently this leads to warnings from calls to strtok() or strchr(). Fix this by properly declaring the respective variable types. |
Holger Hoffstätte <holger@applied-asynchrony.com> | no | 2026-04-06 | ||
| 2026-05-20/0015-fix-signed-integer-overflow-in-proxy-protocol-v2-hea.patch | [PATCH 15/38] fix signed integer overflow in proxy protocol v2 header parsing The len field in the proxy v2 header was declared as signed char, allowing a negative size to bypass the validation check and cause a stack buffer overflow when passed to read_buf() as size_t. This bug was reported by John Walker from ZeroPath, many thanks for the clear report! With the current code this bug does not represent a security issue as it only results in the exit of the forked process that is specific to the attached client, so it is equivalent to the client closing the socket, so no CVE for this, but it is good to fix it to prevent a future issue. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-04-16 | ||
| 2026-05-20/0016-zero-all-new-memory-from-allocations.patch | [PATCH 16/38] zero all new memory from allocations Change my_alloc() to use calloc instead of malloc so all fresh allocations return zeroed memory. Also zero the expanded portion in expand_item_list() after realloc, since it knows both old and new sizes. This gives more predictable behaviour in case of bugs where uninitialised or stale memory is accidentally accessed. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-04-22 | ||
| 2026-05-20/0017-xattrs-fixed-count-in-qsort.patch | [PATCH 17/38] xattrs: fixed count in qsort this fixes the count passed to the sort of the xattr list. This issue was reported here: https://www.openwall.com/lists/oss-security/2026/04/16/2 the bug is not exploitable due to the fork-per-connection design of rsync, the attack is the equivalent of the user closing the socket themselves. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-04-22 | ||
| 2026-05-20/0018-call-tzset-before-chroot-to-cache-timezone-data.patch | [PATCH 18/38] call tzset() before chroot to cache timezone data localtime/localtime_r need /etc/localtime for timezone info. After chroot this file is inaccessible, causing log timestamps to fall back to UTC. Calling tzset() before chroot ensures the timezone data is cached by glibc for subsequent calls. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-04-22 | ||
| 2026-05-20/0019-testsuite-xattrs-ignore-SUNWattr_-in-the-Solaris-xls.patch | [PATCH 19/38] testsuite/xattrs: ignore SUNWattr_* in the Solaris xls helper The Solaris xls() function listed every entry in the file's xattr directory, which on Solaris includes OS-managed SUNWattr_ro and SUNWattr_rw pseudo-attributes. SUNWattr_rw embeds the file creation time, so its bytes naturally differ between the source and destination files, making the xattrs and xattrs-hlink tests fail with diffs that have nothing to do with rsync. Rsync's own listxattr wrapper already filters these out (lib/sysxattrs.c), so the right fix is to filter them in the test display too. Other platforms are unaffected because each has its own xls() branch in the case statement. With the test now actually passing on Solaris, drop the CI hack that overwrote testsuite/xattrs.test with a skip stub. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-04-30 | ||
| 2026-05-20/0020-syscall-use-openat2-RESOLVE_BENEATH-on-Linux-for-sec.patch | [PATCH 20/38] syscall: use openat2(RESOLVE_BENEATH) on Linux for secure_relative_open The CVE fix in commit c35e283 made secure_relative_open() walk every component of relpath with O_NOFOLLOW. That blocks every symlink in the path, which is stricter than the threat model required: legitimate directory symlinks within the destination tree (e.g. when using -K / --copy-dirlinks) are also rejected, breaking delta transfers with "failed verification -- update discarded". See issue #715. On Linux 5.6+, openat2(RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS) gives us exactly what we want: the kernel rejects any resolution that would escape the starting directory (via "..", absolute paths, or symlinks pointing outside dirfd) while still following symlinks that resolve within it. /proc magic-links are blocked too. Use openat2 first; fall back to the existing per-component O_NOFOLLOW walk on ENOSYS (kernel < 5.6). The lexical "../" checks at the head of the function are kept as defense in depth. The Linux gate is plain #ifdef __linux__: the runtime ENOSYS fallback covers the only case that actually matters (header present + old kernel), and any Linux build environment without linux/openat2.h will fail with a clear "no such file" error rather than silently disabling the protection. Verified manually that openat2(RESOLVE_BENEATH) blocks all four escape patterns (absolute symlink, ../ symlink, lexical .., absolute path) while allowing direct and within-tree symlinks. The new testsuite/symlink-dirlink-basis.test (taken from PR #864 by Samuel Henrique) exercises the issue #715 regression and passes; full make check passes 47/47. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-04-30 | ||
| 2026-05-20/0021-syscall-also-use-O_RESOLVE_BENEATH-on-FreeBSD-and-Ma.patch | [PATCH 21/38] syscall: also use O_RESOLVE_BENEATH on FreeBSD and MacOS FreeBSD and MacOS have O_RESOLVE_BENEATH as an openat() flag with the same "must not escape dirfd" semantics as Linux's RESOLVE_BENEATH. The kernel rejects ".." escapes, absolute symlinks, and symlinks whose target lies outside dirfd, while still following symlinks that resolve within it -- the same trade-off that fixes issue #715 on Linux. Add a parallel BSD path in secure_relative_open(), gated on declared. Unlike Linux, BSD doesn't have the header/runtime split where the symbol can exist without kernel support, so no runtime fallback is needed: if the flag compiles in, the kernel honours it. OpenBSD and NetBSD have no equivalent kernel primitive and continue to use the existing per-component O_NOFOLLOW walk; issue #715 remains visible on those platforms (a userland resolver or unveil(2)-based fence would be follow-up work). |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-04-30 | ||
| 2026-05-20/0022-testsuite-skip-symlink-dirlink-basis-on-platforms-wi.patch | [PATCH 22/38] testsuite: skip symlink-dirlink-basis on platforms without RESOLVE_BENEATH secure_relative_open() has a kernel-enforced "stay below dirfd" path on Linux 5.6+ (openat2 RESOLVE_BENEATH) and FreeBSD 13+ (openat O_RESOLVE_BENEATH). On Solaris, OpenBSD, NetBSD, and Cygwin the code falls back to the per-component O_NOFOLLOW walk, which by design rejects every directory symlink in the path -- the very case this test exercises. Mark the test skipped there rather than have it fail with a known regression that's tracked separately. macOS is intentionally not in the skip list: although it does not have O_RESOLVE_BENEATH either, the test passes there in practice; investigation of the underlying reason is left as follow-up. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-04-30 | ||
| 2026-05-20/0023-syscall-clientserver-am_chrooted-and-use_secure_syml.patch | [PATCH 23/38] syscall+clientserver: am_chrooted and use_secure_symlinks for daemon-no-chroot (CVE-2026-29518) CVE-2026-29518: an rsync daemon configured with "use chroot = no" is exposed to a TOCTOU race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open(), redirecting reads (basis-file disclosure) and writes (file overwrite) outside the module. Under elevated daemon privilege this allows privilege escalation. Default "use chroot = yes" is not exposed. Add secure_relative_open() in syscall.c. It walks the parent components under RESOLVE_BENEATH (Linux 5.6+) / O_RESOLVE_BENEATH (FreeBSD 13+, macOS 15+) / per-component O_NOFOLLOW elsewhere, anchored at a trusted dirfd, so a parent- symlink swap is rejected by the kernel. Route the receiver's basis-file open in receiver.c through it when use_secure_symlinks is set in clientserver.c rsync_module(). |
Andrew Tridgell <andrew@tridgell.net> | no | 2025-12-31 | ||
| 2026-05-20/0024-sender-fix-read-path-TOCTOU-by-opening-from-module-r.patch | [PATCH 24/38] sender: fix read-path TOCTOU by opening from module root (CVE-2026-29518) The sender's file open was vulnerable to the same TOCTOU symlink race as the receiver-side basis-file open. change_pathname() calls chdir() into subdirectories, which follows symlinks; an attacker could race to swap a directory for a symlink between the chdir and the file open, allowing reads of privileged files through the daemon. Reconstruct the full relative path (F_PATHNAME + fname) and open via secure_relative_open() from the trusted module_dir, which walks each path component without following symlinks. This is independent of CWD, so the chdir race is neutralised. CVE-2026-29518. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-03-01 | ||
| 2026-05-20/0025-syscall-receiver-secure-receiver-side-do_chmod-again.patch | [PATCH 25/38] syscall+receiver: secure receiver-side do_chmod against symlink-race TOCTOU CVE-2026-29518's fix routed the receiver's open() through secure_relative_open(), but every other path-based syscall the receiver runs on sender-controllable paths is vulnerable to the same TOCTOU primitive. This commit closes the chmod variant. Add do_chmod_at() that opens the parent of fname under secure_relative_open() and uses fchmodat() against the resulting dirfd. Gate the secure path on am_daemon && !am_chrooted (the same gate use_secure_symlinks already uses for the receiver basis-file open), so non-daemon callers and chrooted daemons keep the original do_chmod() fast path. Migrate the receiver-side do_chmod() call sites in delete.c, generator.c, rsync.c, and xattrs.c. Adds testsuite/chmod-symlink-race.test (with t_chmod_secure helper) as regression coverage. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-05-04 | ||
| 2026-05-20/0026-util1-secure-change_dir-against-symlink-race-chdir-e.patch | [PATCH 26/38] util1: secure change_dir() against symlink-race chdir-escape The receiver's chdir(2) into a destination subdirectory followed attacker-planted symlinks at every path component. Once CWD escaped the module, every subsequent path-relative syscall (open, chmod, lchown, ...) inherited the escape -- defeating secure_relative_open's RESOLVE_BENEATH anchor against AT_FDCWD, since the anchor itself was now outside the module. Route change_dir's relative target through secure_relative_open() and fchdir() to the resulting dirfd in am_daemon && !am_chrooted mode, so the chdir step itself can no longer follow a parent- symlink. Same treatment applied to the CD_SKIP_CHDIR / set_path_only path so it also can't follow attacker symlinks during path tracking. Adds testsuite/sender-flist-symlink-leak.test covering the sender-side flist resolution variant of the same primitive. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-05-05 | ||
| 2026-05-20/0027-syscall-add-symlink-race-safe-do_-_at-wrappers-and-h.patch | [PATCH 27/38] syscall: add symlink-race-safe do_*_at() wrappers and harden secure_relative_open Add the rest of the path-based syscall wrappers and migrate every receiver-side caller: - do_lchown_at, do_rename_at, do_mkdir_at, do_symlink_at, do_mknod_at, do_link_at, do_unlink_at, do_rmdir_at, do_utimensat_at, do_stat_at, do_lstat_at Same shape as do_chmod_at: open each parent under secure_relative_open(), call the *at() variant against the dirfd, fall through to the bare path-based syscall in non-daemon / chrooted / absolute-path / no-parent cases. macOS's setattrlist-based set_times tier is also routed through the utimensat_at path on daemon-no-chroot. Hardenings to secure_relative_open() itself: - confine basedir resolution under the same kernel mechanism used for relpath (basedirs from --copy-dest / --link-dest are sender-controllable in daemon mode) - reject any '..' component (bare '..', 'foo/..', 'subdir/..') so the per-component O_NOFOLLOW fallback can't escape - return the dirfd we built up from the per-component fallback when the caller passed O_DIRECTORY (otherwise every do_*_at failed with EINVAL on platforms without RESOLVE_BENEATH) Adds testsuite/alt-dest-symlink-race.test and testsuite/secure-relpath-validation.test (with t_secure_relpath helper) as regression coverage for the new hardenings. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-05-05 | ||
| 2026-05-20/0028-util1-syscall-secure-copy_file-source-dest-opens-bar.patch | [PATCH 28/38] util1+syscall: secure copy_file source/dest opens; bare-path defence-in-depth Three related codex audit findings: Finding 3a: copy_file()'s source open in util1.c used do_open_nofollow(), which only rejects a final-component symlink. A parent-component symlink (e.g. --copy-dest=cd where cd -> /outside) follows freely and reads outside the module. Route through secure_relative_open() with O_NOFOLLOW. Finding 3b: generator.c's in-place backup-file create still used a bare do_open with O_CREAT, leaving a tiny but reachable parent-symlink window between the secure unlink (already through do_unlink_at) and the create. Add do_open_at() that goes through a secure parent dirfd, and route the call site through it. Finding 3c: copy_file()'s destination open in unlink_and_reopen() had the same bare-do_open pattern; route through do_open_at as well. Adds testsuite/copy-dest-source-symlink.test and testsuite/bare-do-open-symlink-race.test as regression coverage for both attack shapes. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-05-06 | ||
| 2026-05-20/0029-testsuite-end-to-end-regression-test-for-chdir-symli.patch | [PATCH 29/38] testsuite: end-to-end regression test for chdir-symlink-race testsuite/chdir-symlink-race.test runs an actual rsync daemon (via RSYNC_CONNECT_PROG to avoid the network) configured with "use chroot = no", plants a symlink at module/subdir -> ../outside, and runs four flavours of attacker-shaped transfer (single-file poc_chmod, -r push into the symlinked subdir with --size-only and without, -r push into the module root). All four must leave the outside-the-module sentinel file's mode AND content unchanged. Portability: - file_mode() helper falls back to BSD stat -f %Lp when GNU stat -c %a is unavailable (macOS, FreeBSD). - Pre-saved pristine copy + cmp(1) replaces sha1sum, which differs across platforms (sha1sum / shasum / sha1). Tests are kept running as root in the user-namespace re-exec wrapper used by symlink-race tests so the daemon's setuid path doesn't drop into the test user's identity (which on Linux would mean the chmod-escape code path can't trigger because the test user doesn't have CAP_FOWNER over the outside file). |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-05-05 | ||
| 2026-05-20/0030-token-harden-compressed-token-decoding-against-integ.patch | [PATCH 30/38] token: harden compressed-token decoding against integer overflow The receiver's three compressed-token decoders -- recv_deflated_token (zlib), recv_zstd_token, and recv_compressed_token (lz4) -- accumulated rx_token (a 32-bit signed counter) without overflow checking. A malicious sender could craft a compressed-token stream that walked rx_token past INT32_MAX, with careful manipulation leaking process memory contents to the wire (environment variables, passwords, heap pointers, library pointers -- significantly weakening ASLR and facilitating further exploitation). Cap rx_token at MAX_TOKEN_INDEX = 0x7ffffffe. Fold the bookkeeping into recv_compressed_token_num() and recv_compressed_token_run() shared by all three decoders. Reject negative or out-of-range token values explicitly. Also cap the simple_recv_token literal-block length at the source: any wire-supplied length > CHUNK_SIZE is ill-formed (the matching simple_send_token never writes a chunk larger than CHUNK_SIZE), so reject before looping on attacker-controlled bytes. enabled (the default for protocols >= 30 when both peers advertise it). Disabling compression on the daemon ("refuse options = compress" in rsyncd.conf) is the available workaround. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-04-29 | ||
| 2026-05-20/0031-testsuite-cover-refuse-options-compress-for-the-daem.patch | [PATCH 31/38] testsuite: cover 'refuse options = compress' for the daemon Add a daemon-refuse-compress test that builds a module configured with 'refuse options = compress' and asserts that: 1. an attempted -z transfer to that module fails with an error mentioning --compress, and 2. the same transfer without -z still succeeds. This pins down the documented way to disable all compression on a daemon, which previously had no automated coverage. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-05-01 | ||
| 2026-05-20/0032-receiver-add-parent_ndx-0-guard-mirroring-797e17f.patch | [PATCH 32/38] receiver: add parent_ndx<0 guard, mirroring 797e17f Commit 797e17f ("fixed an invalid access to files array") added a parent_ndx < 0 guard to send_files() in sender.c, but the visually- identical block in recv_files() in receiver.c was not updated. A malicious rsync:// server can therefore drive any connecting client into the same out-of-bounds dir_flist->files[-1] read followed by a file_struct dereference in f_name() one line later. parent_ndx = -1 on the first received flist when the sender omits a leading "." entry; rsync.c flist_for_ndx() does not reject ndx == 0 in that state because the range check evaluates 0 < 0 = false; and read_ndx_and_attrs() only validates ndx with the ITEM_TRANSFER bit set, so iflags=ITEM_IS_NEW (or any other non-transfer iflag word) bypasses the check. Apply the same guard receiver-side. Confirmed: the same PoC (a minimal Python rsyncd that handshakes with CF_INC_RECURSE, sends a no-leading-"." flist, and emits ndx=0 with ITEM_IS_NEW) crashes unpatched 3.4.2 with SEGV_MAPERR si_addr=0x4101a-class in the receiver child; with this guard it exits cleanly with code 2 (RERR_PROTOCOL). The attack surface delta over the sender variant is large: the original was malicious-client -> daemon, this is malicious-server -> any rsync client doing a normal rsync:// or remote-shell pull. Reported by Pratham Gupta (alchemy1729). |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-05-05 | ||
| 2026-05-20/0033-clientserver-fix-hostname-ACL-bypass-when-using-daem.patch | [PATCH 33/38] clientserver: fix hostname ACL bypass when using daemon chroot On an rsync daemon configured with "daemon chroot", the reverse-DNS lookup of the connecting client was performed *after* the chroot had been entered. If the chroot did not contain the files glibc needs for resolution (/etc/resolv.conf, /etc/nsswitch.conf, /etc/hosts, NSS service modules), the lookup failed and client_name() returned "UNKNOWN". Hostname-based deny rules ("hosts deny = *.evil.example") therefore could not match, and an attacker controlling their PTR record could connect from a hostname the administrator had intended to deny. IP-based ACLs were unaffected. Do the reverse DNS lookup before chroot/setuid; client_name() caches its result, so the post-chroot call uses the cached value and hostname-based ACLs work even when DNS is unavailable post-chroot. Adds testsuite/daemon-chroot-acl.test as end-to-end regression coverage. The test sets up an empty chroot directory, configures "hosts deny = <localhost-resolved-name>" with daemon chroot, and asserts the connection is refused with @ERROR access denied. Uses unshare --user --map-root-user for non-root CAP_SYS_CHROOT; skips cleanly on non-Linux or when user namespaces aren't available. |
Andrew Tridgell <andrew@tridgell.net> | no | 2025-12-31 | ||
| 2026-05-20/0034-defence-in-depth-bound-wire-supplied-counts-and-leng.patch | [PATCH 34/38] defence-in-depth: bound wire-supplied counts and lengths Multiple receiver-side fields read from the wire were trusted without upper-bound checks. A hostile peer could either request extreme allocations (DoS via --max-alloc) or, on platforms where read_varint returned a negative value, push ~SIZE_MAX through the size_t conversion to wrap downstream length checks. Introduce read_int_bounded(), read_varint_bounded() and read_varint_size() in io.c so wire-derived integer ranges are checked at the read site rather than scattered across each caller, with RERR_PROTOCOL on out-of-range input. Apply the bounded primitives to: - sum->count (checksum count -- previously could overflow (size_t)count * xfer_sum_len on 32-bit with raised max-alloc) - xattrs: count, name_len, datum_len, plus rel_pos overflow detect to stop chain wrapping the num accumulator - acls: ida-entry count - flist: file mode S_IFMT validation, modtime_nsec range check - delete-stat counters in main: per-summand cap so the total can't overflow a signed 32-bit accumulator Reporters include Joshua Rogers (checksum-count overflow finding). |
Andrew Tridgell <andrew@tridgell.net> | no | 2025-12-31 | ||
| 2026-05-20/0035-defence-in-depth-guard-cumulative-snprintf-against-l.patch | [PATCH 35/38] defence-in-depth: guard cumulative snprintf against length underflow Two cumulative-snprintf patterns in log.c (rsyserr) and main.c (output_itemized_counts) had the shape len = snprintf(buf, sizeof buf, ...); len += snprintf(buf+len, sizeof buf - len, ...); with no guard between calls. snprintf returns the would-have-been length on truncation, so a truncated first call leaves "sizeof buf - len" as a negative-then-promoted-to-size_t value, underflowing into a huge size_t and writing past buf. Realistic exposure is small in both cases (log header well under buffer, only ~5 itemized iterations writing ~25 chars each into a 1024-byte buffer) but the defect class matches bb0a8118 and the fix is cheap. Guard before each subsequent call. |
Andrew Tridgell <andrew@tridgell.net> | no | 2026-05-01 | ||
| 2026-05-20/0036-defence-in-depth-receiver-block-index-bounds-read_de.patch | [PATCH 36/38] defence-in-depth: receiver block-index bounds + read_delay_line null check Two assorted audit findings: - receive_data() never bounds-checked the block index returned by recv_token() against sum.count before computing offset2 and feeding it to map_ptr(). An out-of-bounds index from a hostile sender produces invalid memory access. Add a sum.count bounds check. - read_delay_line()'s strchr() call could return NULL when no space was found, but the code unconditionally added 1 to the result before dereferencing. Low impact (just a disconnect on exit of the client-specific forked process) but the NULL deref is real. Guard the NULL. Both reported by Joshua Rogers. |
Andrew Tridgell <andrew@tridgell.net> | no | 2025-12-31 |
All known versions for source package 'rsync'
- 3.4.3+ds1-2 (sid)
- 3.4.2+ds1-2 (forky)
- 3.4.1+ds1-5+deb13u3 (trixie-security)
- 3.4.1+ds1-5+deb13u2 (trixie)
- 3.2.7-1+deb12u5 (bookworm-security)
- 3.2.7-1+deb12u4 (bookworm)