mirror of
https://git.yoctoproject.org/poky
synced 2026-03-09 16:59:40 +01:00
1e04a4df0a
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client. (From OE-Core rev: b49c8f58c20d7deb354a86a34488cb798c49eba3) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
43 lines
1.4 KiB
Diff
43 lines
1.4 KiB
Diff
From 8ad4b5d912fad1df29717dddaa775724da77d299 Mon Sep 17 00:00:00 2001
|
|
From: Andrew Tridgell <andrew@tridgell.net>
|
|
Date: Sat, 23 Nov 2024 11:08:03 +1100
|
|
Subject: [PATCH] refuse fuzzy options when fuzzy not selected
|
|
|
|
this prevents a malicious server providing a file to compare to when
|
|
the user has not given the fuzzy option
|
|
|
|
CVE: CVE-2024-12086
|
|
|
|
Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=8ad4b5d912fad1df29717dddaa775724da77d299]
|
|
|
|
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
|
|
---
|
|
receiver.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/receiver.c b/receiver.c
|
|
index 6b4b369e..2d7f6033 100644
|
|
--- a/receiver.c
|
|
+++ b/receiver.c
|
|
@@ -66,6 +66,7 @@ extern char sender_file_sum[MAX_DIGEST_LEN];
|
|
extern struct file_list *cur_flist, *first_flist, *dir_flist;
|
|
extern filter_rule_list daemon_filter_list;
|
|
extern OFF_T preallocated_len;
|
|
+extern int fuzzy_basis;
|
|
|
|
extern struct name_num_item *xfer_sum_nni;
|
|
extern int xfer_sum_len;
|
|
@@ -716,6 +717,10 @@ int recv_files(int f_in, int f_out, char *local_name)
|
|
fnamecmp = get_backup_name(fname);
|
|
break;
|
|
case FNAMECMP_FUZZY:
|
|
+ if (fuzzy_basis == 0) {
|
|
+ rprintf(FERROR_XFER, "rsync: refusing malicious fuzzy operation for %s\n", xname);
|
|
+ exit_cleanup(RERR_PROTOCOL);
|
|
+ }
|
|
if (file->dirname) {
|
|
pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, file->dirname, xname);
|
|
fnamecmp = fnamecmpbuf;
|
|
--
|
|
2.40.0
|