Race Condition in Rsync's Symbolic Link Handling Affects Red Hat Systems

CVE-2024-12747

Summary

A vulnerability exists in rsync due to a race condition detected in its handling of symbolic links. By default, rsync skips symbolic links; however, if an attacker replaces a regular file with a symbolic link during a critical operation, they can exploit this timing issue. Such an exploit may allow the attacker to bypass rsync's default behavior, potentially leaking sensitive information or facilitating privilege escalation, depending on the permissions of the rsync process. This vulnerability necessitates immediate attention to mitigate unauthorized access risks.

References