CVE-2024-12084 Almalinux — Exploit & Vulnerability Details CRITICAL

Parameter	Value
CVSS	9.8 (CRITICAL)
Affected Versions	before 24.11
Fixed In	24.11
Type	CWE-122 (Heap-based Buffer Overflow), CWE-787 (Out-of-bounds Write)
Vendor	Almalinux
Public PoC	No

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

None

No privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

High

Complete data modification

Availability

High

Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-122 Heap-based Buffer Overflow

CWE-787 Out-of-bounds Write

Vulnerable Products 10

Configuration	From (including)	Up to (excluding)
Samba Rsync cpe:2.3:a:samba:rsync:3.2.7:-::::::	—	—
Samba Rsync cpe:2.3:a:samba:rsync:3.3.0:-::::::	—	—
Almalinux Almalinux cpe:2.3:o:almalinux:almalinux:10.0:-::::::	—	—
Archlinux Arch_Linux cpe:2.3:o:archlinux:arch_linux:-:::::::*	—	—
Gentoo Linux cpe:2.3:o:gentoo:linux:-:::::::*	—	—
Nixos Nixos cpe:2.3:o:nixos:nixos::::::::	—	`24.11`
Nixos Nixos cpe:2.3:o:nixos:nixos:24.11:::::::*	—	—
Novell Suse_Linux cpe:2.3:o:novell:suse_linux:-:::::::*	—	—
Tritondatacenter Smartos cpe:2.3:o:tritondatacenter:smartos::::::::	—	`20250123`
Redhat Enterprise_Linux cpe:2.3:o:redhat:enterprise_linux:10.0:::::::*	—	—