Executive brief
rsync is a widely used utility for efficiently transferring and synchronizing files between systems. A vulnerability exists when rsync is used to sync extended file attributes (xattrs), which could allow a malicious sender to crash the receiving process or potentially leak sensitive information from the system's memory. This issue primarily affects backup servers and automated synchronization tasks that use the --xattrs or --fake-super options.
Technical details
A use-after-free (UAF) vulnerability exists in the receive_xattr() function in xattrs.c. The function uses a wire-supplied 'count' value as the length argument for qsort() instead of the actual number of items validated and stored in the temp_xattr array. When xattr filtering or namespace prefixing (common in --fake-super mode) discards items, the array contains stale pointers from previously processed files. qsort reorders these stale entries into the active list, which are then stored in the global rsync_xal_l list. This leads to UAF conditions, double-frees, or heap metadata leaks when the receiver later attempts to process or free these dangling pointers. The vulnerability is fixed in rsync version 3.4.2.
Affected products
- Samba rsync 3.0.1 through 3.4.1
Timeline
- 2008-03-07: other: Vulnerability introduced in commit d724dd186 (rsync 3.0.1pre1)
- 2026-04-16: disclosed: Public disclosure on oss-security mailing list
- 2026-04-16: advisory: CVE-2026-41035 assigned
- 2026-04-28: patched: Fixed in rsync version 3.4.2