CVE-2024-12084

Katalog CVE

CVSS 9.8 · Critical EPSS 72,1%

Kerentanan Heap-based Buffer Overflow pada samba rsync, almalinux +6 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut redhat.com.

Deskripsi (NVD)

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

Rincian

Terbit di NVD

15 Januari 2025

Terakhir diubah

29 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

72,1% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj exploit · advisory vendor
• https://access.redhat.com/security/cve/CVE-2024-12084 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2330527 issue tracking · advisory pihak ketiga
• https://kb.cert.org/vuls/id/952657 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2025/01/14/6 mailing list · advisory pihak ketiga
• https://access.redhat.com/errata/RHBA-2025:6470
• https://security.netapp.com/advisory/ntap-20250131-0002/
• https://www.kb.cert.org/vuls/id/952657