Executive brief
csync2, a tool used to synchronize files across multiple servers in a cluster, contains a flaw in how it handles temporary files when built using modern programming standards (C99 or later). This vulnerability allows a local attacker to interfere with the file synchronization process, potentially leading to a denial-of-service where the tool fails to operate correctly. This could disrupt automated data backups or configuration management across a server cluster.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists in csync2 due to a faulty autotools macro (AC_TRY_RUN) in configure.ac. The macro, intended to detect a secure mkstemp() implementation, lacks an explicit 'int' return type for the main() function. When compiled with C99 or later, this causes the feature check to fail, forcing the application to fallback to the insecure mktemp() function in rsync.c. A local attacker can exploit this race condition to manipulate temporary files, leading to a denial-of-service. A patch is available that adds the missing return type to the configuration script.
Affected products
- SUSE csync2 unspecified
Timeline
- 2026-04-21: disclosed: Vulnerability reported to SUSE Bugzilla
- 2026-04-21: patched: Patch submitted to SUSE Bugzilla
- 2026-05-13: advisory: CVE published to NVD