rsync - Aug 2022 - CVE-2022-29154 and v3.2.3

Greetings all,

I am curious if CVE-2022-29154 affects rsync 3.2.3 or rrsync 3.2.3 and
earlier. More specifically, I am curious if the commit to use
protected arguments as default [0] introduced the CVE (if so,
v3.2.4pre1 is not affected).

The protect args as default commit affects some of the variables
mentioned in the Restriction enforcement thread [1]. This commit also
introduces the old_style_args flag. In the main patch for the CVE [2],
if old_style_args is set to true then the add_implied_include function
promptly returns.

Thank you for your consideration and insight,
Mark Esler

[0]
https://git.samba.org/?p=rsync.git;a=commit;h=6b8db0f6440b28d26ef807d17517715c47e62bd9
[1] https://www.mail-archive.com/rsync at lists.samba.org/msg33452.html
[2]
https://git.samba.org/?p=rsync.git;a=commit;h=b7231c7d02cfb65d291af74ff66e7d8c507ee871

On Wed, Aug 17, 2022 at 9:30 AM Mark Esler wrote:
> I am curious if CVE-2022-29154 affects rsync 3.2.3 or rrsync 3.2.3 and
> earlier.

The security page <https://rsync.samba.org/security.html> covers this:
it's
all versions prior to 3.2.5.

if old_style_args is set to true then the add_implied_include
function
> promptly returns.
>
The NEWS <https://download.samba.org/pub/rsync/NEWS#3.2.5> discusses this
under PACKAGING: the new verification feature requires the quoted args
feature from 3.2.4. Without that change, rsync can't reliably determine
what the remote arguments actually are (many people add quotes to old-style
args, expect splitting on spaces, variables can be expanded, etc).  Asking
to use unprotected remote args therefore implies trusting the sender.
There is some discussion about this in the manpage
<https://download.samba.org/pub/rsync/rsync.1#opt--trust-sender>.

One alternative would be to force --protect-args on by default (there is a
configure --with-protected-args option for that) and then base the security
bypass on protect_args being 0 instead of old_style_args being non-0.

..wayne..
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.samba.org/pipermail/rsync/attachments/20220817/1b477885/attachment.htm>