CVE-2024-12085 PoC — Rsync: info leak via uninitialized stack contents

Source

https://github.com/Otsutez/cve-2024-12085

Associated Vulnerability

Title: Rsync: info leak via uninitialized stack contents (CVE-2024-12085)
Description:A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

Readme

# CVE-2024-12085 Infoleak exploit

Note, this exploit is not versatile! Target module and checksums are hardcoded. Automatic checksum calculation has yet to be implemented.

## Miscellaneous files

`port-forwarding.py` is modified from https://gist.github.com/WangYihang/e7d36b744557e4673d2157499f6c6b5e. It's used to capture traffic between rsync server and client.

`checksum.py` is my attempt at implementing automatic checksum calculation. I didn't have enough time to finish it.

`test.sh` is a script used to test heap allocations in rsync.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →