CVE-2026-29518— Rsync 安全漏洞

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

检查时间与使用时间(TOCTOU)的竞争条件

Rsync 安全漏洞

Rsync是RsyncProject开源的一款快速且用途广泛的文件复制工具。用于远程文件和本地文件。 Rsync 3.4.3之前版本存在安全漏洞，该漏洞源于守护进程文件处理中存在检查时间与使用时间竞争条件，可能导致攻击者通过符号链接替换父目录组件将文件写入重定向到预期目录之外。具有模块路径写入权限的攻击者可利用此竞争条件创建或覆盖任意文件，当守护进程以高权限运行时可能修改敏感系统文件并实现权限提升。

N/A

N/A