--- title: Rsync remote code execution and related vulnerability fixes available description: Canonical’s security team has released updates of the rsync packages for all supported Ubuntu releases. The updates remediate CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087, CVE-2024-12088, and CVE-2024-12747. […] url: https://canonical.com/blog/rsync-remote-code-execution?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [eslerm](https://canonical.com/blog/author/eslerm "More about eslerm") 14 January 2025 # Rsync remote code execution and related vulnerability fixes available [Security](https://canonical.com/blog/tag/security) [Vulnerabilities](https://canonical.com/blog/tag/vulnerabilities) --- Share the article Security researchers at Google (Pedro Gallegos, Simon Scannell, and Jasiel Spelman) discovered vulnerabilities in the rsync server and rsync client. The rsync server vulnerabilities ([CVE-2024-12084](https://ubuntu.com/security/CVE-2024-12084) and [CVE-2024-12085](https://ubuntu.com/security/CVE-2024-12085)) ultimately allow remote code execution (RCE). The rsync client vulnerabilities allow a malicious server to read arbitrary files ([CVE-2024-12086](https://ubuntu.com/security/CVE-2024-12086)), create unsafe symlinks ([CVE-2024-12087](https://ubuntu.com/security/CVE-2024-12087)) and overwrite arbitrary files in certain circumstances ([CVE-2024-12088](https://ubuntu.com/security/CVE-2024-12088)). During the coordinated vulnerability response of the above issues, a sixth vulnerability ([CVE-2024-12747](https://ubuntu.com/security/CVE-2024-12747)) which affects how the rsync server handles symlinks was reported by Aleksei Gorban. Canonical’s security team has released updates of the `rsync` packages for all supported Ubuntu releases. The updates remediate [CVE-2024-12084](https://ubuntu.com/security/CVE-2024-12084), [CVE-2024-12085](https://ubuntu.com/security/CVE-2024-12085), [CVE-2024-12086](https://ubuntu.com/security/CVE-2024-12086), [CVE-2024-12087](https://ubuntu.com/security/CVE-2024-12087), [CVE-2024-12088](https://ubuntu.com/security/CVE-2024-12088), and [CVE-2024-12747](https://ubuntu.com/security/CVE-2024-12747). Information on the affected versions can be found in the CVE pages linked above. # How the exploits work Google researchers discovered that the rsync server is vulnerable to a heap buffer overflow ([CVE-2024-12084](https://ubuntu.com/security/CVE-2024-12084)) and an information leak of uninitialized stack data ([CVE-2024-12085](https://ubuntu.com/security/CVE-2024-12085)). By combining the two vulnerabilities, a malicious client with anonymous read-access can defeat ASLR (address space layout randomization) and remotely execute arbitrary code on the rsync server machine. These vulnerabilities were introduced in rsync v3.2.7, so Ubuntu 20.04 LTS and earlier releases are not vulnerable to this attack chain. Three additional vulnerabilities affect the rsync client. [CVE-2024-12086](https://ubuntu.com/security/CVE-2024-12086) is a path traversal vulnerability which allows a malicious server to read any file the client process can access. [CVE-2024-12087](https://ubuntu.com/security/CVE-2024-12087) allows a malicious server to bypass –safe-links and create unsafe symbolic links. [CVE-2024-12088](https://ubuntu.com/security/CVE-2024-12088) is another path traversal vulnerability which allows a malicious server to overwrite arbitrary files on the client’s machine under certain circumstances. Aleksei Gorban discovered an additional vulnerability in the rsync server ([CVE-2024-12747](https://ubuntu.com/security/CVE-2024-12747)). In this case, rsync improperly handles symlinks during a race condition and can be used to leak sensitive information to a remote attacker. # Affected releases | | | | | --- | --- | --- | | **Release** | **Package Name** | **Fixed Version** | | Trusty (14.04 LTS) | rsync | 3.1.0-2ubuntu0.4+esm1 | | Xenial (16.04 LTS) | rsync | 3.1.1-3ubuntu1.3+esm3 | | Bionic (18.04 LTS) | rsync | 3.1.2-2.1ubuntu1.6+esm1 | | Focal (20.04 LTS) | rsync | 3.1.3-8ubuntu0.8 | | Jammy (22.04 LTS) | rsync | 3.2.7-0ubuntu0.22.04.3 | | Noble (24.04 LTS) | rsync | 3.2.7-1ubuntu1.1 | | Oracular (24.10) | rsync | 3.3.0-1ubuntu0.1 | # How to check if you are impacted On your system, run the following command and compare the listed version to the table above. ``` dpkg -l rsync ``` # How to address We recommend you upgrade all packages: ``` sudo apt update && sudo apt upgrade ``` If this is not possible, the affected component can be targeted: ``` sudo apt update && sudo apt install --only-upgrade rsync ``` The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service applies new security updates every 24 hours automatically. In other words, if you have this enabled, the patches above will be automatically applied within 24 hours of being available. # Acknowledgements Many thanks to Pedro Gallegos, Simon Scannell, and Jasiel Spelman at Google for their researching and reporting these vulnerabilities, to Aleksei Gorban for their research, to Andrew Tridgell and Wayne Davison from rsync for creating security patches, and to CERT/CC’s VINCE for vulnerability coordination. For a cost-effective, compliant and supported open source stack – try Ubuntu Pro. [Get your first month free!](https://ubuntu.com/pro/subscribe) # References [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### PinTheft Linux kernel vulnerability mitigation](https://canonical.com/blog/pintheft-linux-kernel-vulnerability-mitigation) A local privilege escalation (LPE) security vulnerability in the Linux kernel, codename “PinTheft,” was publicly disclosed on May 19, 2026. The vulnerability was fixed in the... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 21 May 2026