rsync 3.5.2 Security Update Fixes CPU Exhaustion Flaw

rsync 3.5.2 resolves a security flaw enabling malicious actors to overwhelm server processing capabilities through manipulated checksum calculations.

Critical Vulnerability Addressed

The rsync development team released version 3.5.2, which resolves a security flaw enabling malicious actors to overwhelm server processing capabilities through manipulated checksum calculations. The update introduces enhanced resource management features that allow transfers to be deprioritized during high system load.

How rsync Works

rsync remains a widely adopted open-source utility for file synchronization across local and networked environments, commonly used for software archive mirroring and backup operations. Its efficiency stems from transmitting only modified file segments, reducing bandwidth usage. The protocol employs a dual-checksum mechanism where the receiving system divides files into blocks and transmits lightweight rolling checksums alongside stronger cryptographic hashes. The sender then compares these values using a sliding window approach to identify matching segments.

Vulnerability Details

A vulnerability exists in the hash_search() function within match.c, where a malicious receiver can generate colliding weak checksums paired with non-matching strong hashes. This forces the sender to repeatedly compute invalid strong checksums, exhausting CPU resources. Exploitation requires no authentication for public daemon modules, allowing unauthenticated attackers to initiate malicious connections. All versions prior to 3.5.2 are susceptible to this issue.

VulnCheck categorizes the flaw as an inefficient algorithmic complexity vulnerability, assigning a CVSS 4.0 score of 8.7 and a CVSS 3.1 score of 7.5, both focused on availability impacts.

Update Features and Enhancements

The update introduces process-priority controls through the –nice and –no-nice parameters, enabling administrators to adjust CPU and I/O scheduling priorities for local and remote processes. These settings operate independently, with daemon clients able to request specific priority configurations. The restricted SSH wrapper rrsync supports local priority adjustments even when remote systems lack compatibility. The patch ensures transfers continue when local policy violations occur, while remote priority settings require mutual support between client and server.