Executive brief
Rsync is a widely used utility for efficiently transferring and synchronizing files between systems. A vulnerability in certain versions allows a local attacker to trick the software into modifying files outside of its designated folder. This could lead to unauthorized changes to system file permissions, ownership, or timestamps, potentially compromising the integrity of the host system.
Technical details
Rsync is vulnerable to a Time-of-Check Time-of-Use (TOCTOU) race condition during path-based system calls such as chmod, lchown, utimes, and rename. When an rsync daemon is configured with 'use chroot = no', a local attacker can exploit the timing window between path resolution and syscall execution by swapping symlinks. This allows the attacker to redirect file operations to arbitrary locations outside the intended module boundary, applying sender-supplied permissions, ownership, or filenames to sensitive system files. The issue is addressed in version 3.4.3 by utilizing more secure file handling methods like openat2 with RESOLVE_BENEATH where available.
Affected products
- RsyncProject rsync <= 3.4.2
Timeline
- 2026-05-19: disclosed
- 2026-05-20: patched: Fixed in version 3.4.3
- 2026-05-20: advisory