CVE-2026-70456

Executive Summary

CVE-2026-70456 is an out-of-bounds write vulnerability in rsync (affecting versions 3.0.1 through 3.4.x) that enables a malicious sender to corrupt adjacent heap memory by sending a crafted argument list during rsync handshake. The flaw resides in the read_args() function, where an off-by-one write occurs: when the argument count causes the argv allocation to be precisely full, the trailing NULL terminator is written one slot beyond the allocation boundary.

The vulnerability is remotely exploitable with no authentication required (CVSS: 8.2, high severity), although the impact is limited to integrity loss and high availability impact — no confidentiality breach. At the time of writing, no public proof-of-concept is available, no exploitation in the wild has been reported, and the vendor has not released a patch (confidence 0/4). Any rsync deployment listening as a daemon on port 873, or any client connecting to a malicious server, is potentially exposed.

Technical Analysis

Vulnerability Mechanism

The vulnerability is a classic heap-based out-of-bounds write — an off-by-one error in memory allocation handling. Specifically, the read_args() function (responsible for parsing the argument list received during rsync protocol negotiation) performs memory allocation for the argv array based on an attacker-controlled argument count.

The flaw manifests as follows:

1. Allocation sizing: The function allocates a block of heap memory intended to hold argv entries (the argument pointers).
2. Off-by-one boundary condition: When the argument count provided by the remote party exactly fills the allocated array — i.e., there are exactly N arguments for an N-slot allocation — the code proceeds to write a NULL terminator ((char *)0) at index N, which is one slot beyond the heap allocation boundary.
3. Heap corruption: This write corrupts adjacent heap metadata or data, potentially leading to memory corruption, denial of service (crash), or in more severe scenarios, arbitrary code execution if the adjacent heap chunk contains control data (e.g., size fields, function pointers).

Attack Surface

• Rsync daemon mode (rsync --daemon): Listens on TCP port 873. Any unauthenticated remote client can initiate a connection and send arbitrary argument lists during the initial protocol handshake, directly triggering the vulnerable read_args() path.
• Rsync client mode: A client connecting to a malicious rsync server could receive a crafted argument list in response, also triggering the vulnerability.
• rsync between two non-daemon endpoints: The protocol is symmetric; either side can send argument lists.

Code-Level Explanation (from NVD Description)

The NVD description explicitly identifies:

• Function: read_args()
• Root cause: When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary.
• Result: Corruption of adjacent heap memory (CWE-787).

No additional function names, API paths, or implementation details are provided in the source data. The vulnerability class is a heap off-by-one write with network-triggerable conditions.

Attack Preconditions

• Network access to an rsync service (TCP 873 default) or ability to lure a victim into connecting to a malicious rsync server.
• No authentication required.
• No user interaction required.
• Low attack complexity: the malformed argument list is trivial to construct once the protocol format is understood.

Exploitation Scenarios

Critical note: No public PoC is available at this time. The attack chain below is inferred strictly from the vulnerability class and NVD description.

Step 1: Reconnaissance / Target Identification

• Scan for rsync services on port 873 using Shodan queries (port:873 product:rsync) or network scanning (masscan/nmap with service detection).
• Banner grabbing can identify the rsync version: many daemons expose version information in the connection banner (e.g., @RSYNCD: 3.1.3).
• Alternatively, target internal assets identified via asset management inventory as running rsync for backup, mirroring, or deployment tasks.

Step 2: Triggering the Flaw

• Establish a TCP connection to the rsync daemon on port 873.
• During protocol negotiation, send a crafted argument list where the argument count exactly matches the argv allocation size.
• When read_args() finishes populating the array with that exact count, the trailing NULL terminator write overflows by one slot, corrupting adjacent heap memory.

Step 3: Payload / Execution Method (Class-Level)

• Heap grooming: Before sending the triggering argument list, an attacker may need to manipulate heap layout to ensure the corrupted slot is adjacent to a target heap chunk (e.g., a chunk containing size metadata or function pointers).
• Denial of service: The simplest outcome — corrupting heap metadata likely causes a crash (SIGSEGV/SIGABRT) in the rsync daemon, knocking it offline.
• Potential code execution: If the adjacent heap chunk contains a function pointer or size field that influences a subsequent allocation or call, the attacker may achieve arbitrary code execution as the rsync daemon user (often root when daemon runs as root).
• Integrity impact: Successful corruption may allow an attacker to manipulate rsync's behavior to write arbitrary data to filesystem locations accessible by the rsync process (e.g., overwrite authorized_keys, cron entries, or other sensitive files).

Step 4: Post-Exploitation Impact

• Daemon compromise: If code execution is achieved, the attacker gains access to the daemon process's privileges (commonly root in default daemon configurations).
• Persistence: Writing a cron job or SSH key is trivial if daemon runs as root.
• Lateral movement: Compromised rsync daemons on internal networks can be leveraged to pivot and attack other systems.
• Availability disruption: Even without code execution, crash-based DoS on critical backup/mirroring infrastructure has cascading operational impact.

Impact Assessment

CVSS Component Analysis (Base Score: 8.2, High)

Business Impact

• Backup/mirroring infrastructure outage: rsync is ubiquitous in enterprise backup pipelines, content distribution, and CI/CD synchronization. A crash renders these processes unavailable, impacting data freshness and disaster recovery readiness.
• Potential root compromise: If daemon runs with elevated privileges (common in default configurations), successful exploitation could lead to full host compromise.
• Supply chain risk: rsync is used in mirrors and package distribution; a compromised mirror daemon could inject corrupted artifacts into downstream consumers.

Blast Radius

• Directly affected: Any rsync daemon (3.0.1–3.4.x) exposed on the network.
• Indirectly affected: All systems relying on rsync for data synchronization, backups, or deployment; networks where an rsync service was compromised may face lateral movement.
• 0-day window: With no patch available, all vulnerable rsync deployments remain exposed until a fix is released.

Detection Guidance

Sigma Rule

title: CVE-2026-70456 rsync read_args Heap Overflow Attempt
id: 7f8a4c2e-6b3a-4f2d-9e1c-a5b8d4f7c201
status: experimental
description: Detects potential exploitation of CVE-2026-70456 via rsync daemon crashes or abnormal connection patterns
author: ValtersIT Threat Intelligence
logsource:
    category: process_creation
    product: linux
detection:
    selection_rsync_crash:
        Image|endswith: '/rsync'
        CommandLine|contains|all:
            - '--daemon'
        ExitCode:
            - 139      # SIGSEGV
            - 134      # SIGABRT
    selection_syslog_rsync:
        - 'rsync: memory allocation error'
        - 'rsync: error - '
        - 'rsync: connection unexpectedly closed'
    condition: selection_rsync_crash or selection_syslog_rsync
    timeframe: 5m
fields:
    - Image
    - CommandLine
    - ExitCode
    - dest_ip
falsepositives:
    - Legitimate rsync crashes due to resource exhaustion
    - Kernel OOM killer terminating rsync processes
level: high
tags:
    - attack.t1210
    - cve.2026-70456
    - cwe.787

YARA Rule

rule CVE_2026_70456_rsync_read_args_heap_overflow
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects rsync binary versions vulnerable to CVE-2026-70456 and exploit strings targeting read_args heap overflow"
        cve = "CVE-2026-70456"
        date = "2026-01-01"
        severity = "high"

    strings:
        $version_old = "3.0.1"
        $version_mid = "3.1."
        $version_late = "3.2."
        $version_34 = "3.4."
        $rsync_banner = "@RSYNCD:"
        $heap_overflow_marker = { 00 00 00 00 00 00 00 00 41 41 41 41 } // NULL terminator followed by AAAA

    condition:
        ($rsync_banner and
         any of ($version_old, $version_mid, $version_late, $version_34)) or
        ($heap_overflow_marker and filesize < 2MB)
}

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"CVE-2026-70456 rsync read_args heap overflow attempt"; flow:to_server,established; content:"@RSYNCD:"; depth:20; content:"|00|"; distance:0; within:1; threshold:type both, track by_src, count 10, seconds 60; reference:cve,CVE-2026-70456; classtype:attempted-admin; sid:90070456; rev:1;)

Elastic Detection

// EQL query to detect rsync daemon crashes and abnormal terminations
sequence by process.entity_id
  [ process where process.name == "rsync" and process.args == "--daemon" ]
  [ process where process.name == "rsync" and (
      process.exit_code == 139 or
      process.exit_code == 134 or
      process.exit_code == 11
    )
  ]

Splunk SPL Query

index=linux_syslog sourcetype=syslog (source="/var/log/messages" OR source="/var/log/syslog")
| search "rsync" AND ("Segmentation fault" OR "memory allocation" OR "corrupt" OR "Abort" OR "core dumped")
| or search index=windows_security EventCode=4688 New_Process_Name="*rsync*"
| eval crash_indicator = case(
    like(message, "%segmentation%"), "SIGSEGV - likely heap corruption",
    like(message, "%abort%"), "SIGABRT - likely heap corruption",
    like(message, "%core dumped%"), "Crash detected",
    true, "other")
| where crash_indicator != "other"
| stats count by host, src_ip, crash_indicator, _time
| sort _time desc

Wazuh OSSEC Rule

<group name="rsync_overflow,">
  <rule id="100456" level="12">
    <decoded_as>syslog</decoded_as>
    <match>rsync: Segfault|rsync: memory allocation|rsync: Connection reset by peer</match>
    <description>CVE-2026-70456: rsync read_args heap overflow - daemon crash detected (potential exploitation attempt)</description>
    <group>cve-2026-70456,attack.t1210,cwe-787</group>
    <mitre>
      <id>T1210</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No patch evidence from any tracked source. The fixed version is 3.5.0, but no release announcement, commit, or advisory confirm its availability at this time.

1. Immediate Mitigations

• Disable rsync daemon if not strictly required: systemctl stop rsync && systemctl disable rsync.
• Restrict network exposure: If rsync must remain enabled, restrict access to trusted IP ranges via firewall rules:
  • iptables -A INPUT -p tcp --dport 873 -s <trusted_cidr> -j ACCEPT
  • iptables -A INPUT -p tcp --dport 873 -j DROP
• Use SSH-based rsync: Replace rsync --daemon usage with rsync -e ssh to avoid exposure of the raw rsync protocol. This routes traffic through SSH, bypassing the vulnerable parser on the daemon port entirely.
• Deploy network segmentation: Place rsync services on isolated VLANs inaccessible from the internet.

2. Patch / Upgrade Steps

• Monitor for rsync 3.5.0 release. Upon availability:

  wget https://rsync.samba.org/ftp/rsync/rsync-3.5.0.tar.gz
  tar -xzf rsync-3.5.0.tar.gz
  cd rsync-3.5.0
  ./configure && make && make install
  systemctl restart rsync
  

• Track the rsync security announcement mailing list and vendor repository for official CVE-2026-70456 advisories.
• If running a distribution-provided rsync (Debian, RHEL, Ubuntu), monitor for backported patches and apply immediately upon release via standard package update channels.

3. Long-Term Hardening

• Run rsync daemon as non-root user: Create a dedicated system user (e.g., rsyncuser) and configure the daemon to run with least privilege. This limits post-exploitation impact.
• Implement rate limiting: Use max connections directive in rsyncd.conf to limit connection flooding.
• Deploy host-based IDS: Enable auditd rules to log execve calls for rsync and monitor for crash signals.
• Regular vulnerability scanning: Include port 873 in regular network vulnerability scans to identify exposed rsync services quarterly.
• Monitor Shodan exposure: Periodically check if internal rsync services appear in Shodan's index, indicating unintended internet exposure.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-70456
2. Rsync Official Website: https://rsync.samba.org/ — tracking for 3.5.0 release and security announcements
3. CWE-787 (Out-of-bounds Write): https://cwe.mitre.org/data/definitions/787.html — vulnerability class reference
4. MITRE ATT&CK T1210 (Exploitation of Remote Services): https://attack.mitre.org/techniques/T1210/
5. Shodan Search (rsync daemons): https://www.shodan.io/search?query=port%3A873 — for exposure discovery

Threat Actor Activity / Exploit-in-the-Wild Evidence

• None reported: No active exploitation campaigns, threat actor usage, or exploit-in-the-wild evidence for CVE-2026-70456 was identified at the time of this report.
• CISA KEV: Not listed (NO).
• Nuclei templates: None available (NO).
• Public exploit code: Unknown / not confirmed; PoC status is UNKNOWN.

Warning: Given the criticality of rsync in enterprise infrastructure and the absence of a patch, targeted exploitation in the near term is plausible. Aggressive monitoring and exposure reduction are strongly recommended.