CVE-2024-12084
CRITICAL 9.8 ALL-YEARSA heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
LIKELY TARGET
72.5% modeled chance of exploitation in the next 30 days (99th percentile). Prioritize remediation.
Exploitation likelihood
72.5%chance of exploitation in 30 days · 99th percentile
○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation poc, automatable yes
Impact if exploited
9.8CVSS 3.1 · CRITICAL · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Vendors Red Hat Samba Almalinux Archlinux Gentoo Nixos Novell Tritondatacenter Redhat
Products Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Rsync Almalinux Arch Linux Linux Nixos Suse Linux Smartos Enterprise Linux
Weakness (CWE)
- CWE-122: Heap-based Buffer Overflow
- CWE-787: Out-of-bounds write
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References and research data (JSON)
Vendor product assessments
rsync-daemon-0:3.4.1-2.el10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-rrsync-0:3.4.1-2.el10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=noarch
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-0:3.4.1-2.el10.src as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-debuginfo-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-debuginfo-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-debuginfo-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-debuginfo-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-debugsource-0:3.4.1-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-debugsource-0:3.4.1-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-debugsource-0:3.4.1-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync-debugsource-0:3.4.1-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
- workaround: Red Hat recommends filtering untrusted connections to Rsync via firewall rules on the host and on network firewall appliances. Additionally, systems which only need to provide remote Rsync access to users with known identities can enable authentication using the ```auth users``` parameter in their rsyncd configuration file (rsyncd.conf). Systems that provide anonymous read access to hosted files via Rsync, such as mirror hosts, do not have reasonable mitigation options available. We strongly urge operators using vulnerable versions of Rsync to update as soon as possible.
rsync as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00rsync.src as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync?arch=src
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00rsync as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00rsync.src as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync?arch=src
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00rsync as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00rsync-daemon as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync-daemon
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00rsync.src as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync?arch=src
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00rsync as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00rsync-daemon as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync-daemon
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00rsync-rrsync as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync-rrsync
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00rsync.src as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/rsync?arch=src
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
3 candidates
- https://github.com/themirze/cve-2024-12084PoC-in-GitHub · CVE-2024-12084
PoC-in-GitHub · CVE-2024-12084 · Updated 2025-06-18T11:12:57Z - https://github.com/rxerium/CVE-2024-12084
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
PoC-in-GitHub · CVE-2024-12084
PoC-in-GitHub · CVE-2024-12084 · Updated 2026-05-20T03:40:24Z - https://github.com/InkeyP/CVE-2024-12084
A easy poc for CVE-2024-12084.
PoC-in-GitHub · CVE-2024-12084
PoC-in-GitHub · CVE-2024-12084 · Updated 2025-12-03T09:46:14Z
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Samba | Rsync | 3.2.7 |
| Samba | Rsync | 3.3.0 |
| Almalinux | Almalinux | 10.0 |
| Archlinux | Arch Linux | * |
| Gentoo | Linux | * |
| Nixos | Nixos | < 24.11 |
| Nixos | Nixos | 24.11 |
| Novell | Suse Linux | * |
| Tritondatacenter | Smartos | < 20250123 |
| Redhat | Enterprise Linux | 10.0 |
All CVSS metrics
- CRITICAL 9.8 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CRITICAL 9.8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj CVE record · CISA-ADP · Updated 2026-02-26T19:09:06.939Z
NVD · CVE-2024-12084 · Updated 2026-10-21T17:17:23.127
Advisories
- https://access.redhat.com/errata/RHBA-2025:6470 CVE record · redhat · Updated 2026-10-21T16:06:50.394Z
NVD · CVE-2024-12084 · Updated 2026-10-21T17:17:23.127
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00 - https://access.redhat.com/security/cve/CVE-2024-12084 CVE record · redhat · Updated 2026-10-21T16:06:50.394Z
NVD · CVE-2024-12084 · Updated 2026-10-21T17:17:23.127
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00 - https://bugzilla.redhat.com/show_bug.cgi?id=2330527 CVE record · redhat · Updated 2026-10-21T16:06:50.394Z
NVD · CVE-2024-12084 · Updated 2026-10-21T17:17:23.127
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00 - https://kb.cert.org/vuls/id/952657 CVE record · redhat · Updated 2026-10-21T16:06:50.394Z
NVD · CVE-2024-12084 · Updated 2026-10-21T17:17:23.127
Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00 - http://www.openwall.com/lists/oss-security/2025/01/14/6 CVE record · CVE · Updated 2025-11-03T21:52:08.021Z
NVD · CVE-2024-12084 · Updated 2026-10-21T17:17:23.127 - https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12084.json Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-50580 EUVD · EUVD-2024-50580
Technical & other
- https://security.netapp.com/advisory/ntap-20250131-0002/CVE record · CVE · Updated 2025-11-03T21:52:08.021Z
NVD · CVE-2024-12084 · Updated 2026-10-21T17:17:23.127 - https://www.kb.cert.org/vuls/id/952657CVE record · CVE · Updated 2025-11-03T21:52:08.021Z
NVD · CVE-2024-12084 · Updated 2026-10-21T17:17:23.127 - https://www.cve.org/CVERecord?id=CVE-2024-12084 Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2024-12084 Red Hat · CVE-2024-12084 · Updated 2026-10-21T16:06:46+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS