Rsync: race condition in rsync handling symbolic links
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.6epss 0.4%
exploitation probability
0.4%top 68% of all CVEs
observed exploitation
nono source reports it
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
rsyncRed Hat · Red Hat Discovery 1.14Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat OpenShift Container Platform 4References
https://access.redhat.com/errata/RHBA-2025:6470https://access.redhat.com/errata/RHSA-2025:2600https://access.redhat.com/errata/RHSA-2025:7050https://access.redhat.com/errata/RHSA-2025:8385https://access.redhat.com/security/cve/CVE-2024-12747https://bugzilla.redhat.com/show_bug.cgi?id=2332968https://kb.cert.org/vuls/id/952657https://lists.debian.org/debian-lts-announce/2025/01/msg00008.htmlhttps://security.netapp.com/advisory/ntap-20250131-0002/https://www.kb.cert.org/vuls/id/952657