CVE-2024-12085

CVE-2024-12085 is a high-severity vulnerability in rsync that allows an attacker to leak one byte of uninitialized stack data at a time by manipulating checksum lengths during file comparisons. This flaw impacts numerous Linux distributions and products, including AlmaLinux, Arch Linux, Gentoo, NixOS, Red Hat, Samba, SUSE, and Triton DataCenter. With a CVSS score of 7.5 (High), the vulnerability is network-exploitable with low attack complexity, posing a significant risk of information disclosure. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered substantial community discussion and media coverage, indicating a high level of awareness and potential for future exploitation.