CVE-2024-12084
Published: 15 January 2025
Summary
CVE-2024-12084 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Samba Rsync. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 12.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation directly addresses the heap-based buffer overflow in rsync daemon by applying vendor patches like RHBA-2025:6470 to eliminate the vulnerability.
Memory protection mechanisms such as heap isolation and randomization mitigate exploitation of the out-of-bounds write in the sum2 buffer.
Information input validation enforces bounds checking on attacker-controlled checksum lengths like s2length to prevent exceeding the fixed SUM_LENGTH.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow and related flaws in rsync daemon enable remote code execution on servers via anonymous client access (T1068, T1190, T1210); file leak vulnerability facilitates collection of arbitrary data from clients' local systems (T1005).
NVD Description
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of…
more
bounds in the sum2 buffer.
Deeper analysisAI
CVE-2024-12084 is a heap-based buffer overflow vulnerability in the rsync daemon, stemming from improper handling of attacker-controlled checksum lengths (s2length) in the code. The flaw occurs when MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH of 16 bytes, allowing an attacker to write out of bounds in the sum2 buffer. It is associated with CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
The vulnerability can be exploited by a remote attacker with network access to the rsync daemon, requiring no privileges, low complexity, and no user interaction. Exploitation enables out-of-bounds writes in heap memory, potentially compromising confidentiality, integrity, and availability to a high degree.
Red Hat has issued advisory errata RHBA-2025:6470 to address the issue, with further details in their CVE security page, Bugzilla entry #2330527, CERT vulnerability note 952657, and an oss-security mailing list announcement from January 14, 2025.
Details
- CWE(s)