Thirty-three CVEs published for rsync.

Hi there,

You may have seen the recent unusually long list of CVEs for rsync.
Here's my assessment of how they affect rsync-bpc, and may therefore
affect BackupPC installations which use rsync-bpc.

First, though, if you use rsync itself (as opposed to the modified
version of rsync embodied in rsync-bpc) be aware that some of these
CVEs can theoretically be exploited by a remote peer so the previous
advice about rsync itself still stands:

(1) on no account expose rsync directly to the Internet and

(2) as soon as possible upgrade all copies of rsync.  Even if you do
not yourself use rsync, it may be that a vulnerable version could be
somehow used in an attack exploiting multiple vulnerabilities.  This
kind of thing is increasingly an issue as the Bad Guys find more and
more ways to use AI in their toolkits.

Of course do not expose BackupPC to the Internet.  If you do need to
back up remote hosts use an encrypted channel such as a VPN or set up
rsync-over-SSH (BackupPC's configuration file shows a way to do that).

If you do not use rsync-bpc for backups you can stop reading now. :)

The list below is taken from "NEWS for rsync 3.5.0 (13 Aug 2026)" at

https://download.samba.org/pub/rsync/NEWS.md

So that I could group the CVEs into those that can affect rsync-bpc
and those that can't, this list does not follow the order in which
they're given in NEWS.md.  Within the groups I've sorted them in order
of severity.

Firstly the issues that I assess as not affecting rsync-bpc/BackupPC:
---------------------------------------------------------------------
rsync:
- CVE-2026-53802 (HIGH): Arbitrary file read / transfer-shaping ...
- CVE-2026-53803 (HIGH): Arbitrary file write / privilege escalation ...
- CVE-2026-53785 (HIGH): Under `--relative` ...
- CVE-2026-53784 (HIGH): Daemon module-root chdir escape ...
- CVE-2026-53793 (HIGH): Chroot `/./` inner-module escape ...
- CVE-2026-53795 (HIGH): An absolute `--temp-dir` or `--link-dest` ...
- CVE-2026-53796 (MEDIUM): A non-daemon receiver's one-time `chdir()` ...
- CVE-2026-53797 (MEDIUM): A non-daemon sender ...
- CVE-2026-53799 (MEDIUM): ... granting rwx on a root-owned file. ...
- CVE-2026-53800 (MEDIUM): ... delete a file outside the served tree. ...
- CVE-2026-53801 (MEDIUM): ... out-of-tree disclosure. ...

The eleven CVEs above are link following attacks, so need a privileged
rsync.  BackupPC runs rsync-bpc runs as an unprivileged user (usually
'backuppc', but see $Conf{BackupPCUser}) so they are not applicable to
a BackupPC installation.  Also, when writing, in any case rsync-bpc
overrides the destination file location to the BackupPC pool - it does
not write to arbitrary locations in a potential victim filesystem.

- CVE-2026-53791 (CRITICAL): With `proxy protocol = true` ...
- CVE-2026-70464 (HIGH): ... complete the `@RSYNCD` greeting and then stall ...
- CVE-2026-70455 (HIGH): ... request an arbitrary Zstandard worker count ...
- CVE-2026-70453 (HIGH): quadratic CPU exhaustion ...
- CVE-2026-70452 (HIGH): `hosts deny` failed OPEN ...
- CVE-2026-70463 (HIGH): `auth users` ignored its documented comma-only ...
- CVE-2026-70460 (HIGH): ... an in-module symlink could redirect ...
- CVE-2026-70457 (MEDIUM): attacker-chosen-offset ... forwarded to a daemon.
- CVE-2026-70459 (MEDIUM): ... crashing ... daemon child ...
- CVE-2026-53786 (MEDIUM): ... bypassed the module filter list ...
- CVE-2026-53798 (MEDIUM): ... stored metadata became root-owned. ...
- CVE-2026-53788 (MEDIUM): ... name containing a newline/CR ...

BackupPC does not use rsync-bpc as a daemon, so it is not vulnerable
to the above twelve CVEs.

- CVE-2026-53792 (MEDIUM): A malicious receiver ...

BackupPC would be the malicious receiver in this case.  Easy fix.

- CVE-2026-53790 (HIGH): ... injection via `RSYNC_CONNECT_PROG` `%H` ...

BackupPC is entirely in control of the connection arguments so this is
a no-op - you can do whatever you like in .../BackupPC/config.pl and
there's no fix for that!

rrsync, rsync-ssl:
- CVE-2026-53783 (HIGH): rrsync restricted-directory escape.
- CVE-2026-70454 (MEDIUM): `rsync-ssl` ... unauthenticated TLS connection. ...

BackupPC uses neither rrsync nor rsync-ssl so the above two CVEs are
not relevant to a BackupPC installation.

Secondly the issues I assess as possibly affecting rsync-bpc/BackupPC:
----------------------------------------------------------------------

- CVE-2026-70461 (HIGH): a one-byte heap out-of-bounds write ...
- CVE-2026-70458 (HIGH): an out-of-bounds write from a file entry ...
- CVE-2026-70456 (HIGH): an out-of-bounds heap write in `read_args()` ...

The above three issues will take first priority.  Two of them write
out of bounds by only one byte, but out of bounds is out of bounds -
you can never really be sure what damage might be done.

- CVE-2026-53789 (MEDIUM): ... daemon-sender could widen `--delete` scope ...

An attack based on the above vulnerability is plausible if a client
that BackupPC serves has been compromised.  It seems possible that an
attack might result in the deletion of pool files although it would be
quite a lot of work for probably very limited reward.  It doesn't seem
to me to be a serious issue but it will be next on my list.

- CVE-2026-70462 (MEDIUM): a peer-supplied `MSG_IO_TIMEOUT` ...
- CVE-2026-53794 (MEDIUM): `--max-alloc=0` disabled the ... cap ...

Timeout and max-alloc arguments would normally be set by the BackupPC
server so these seem like minor issues and they are easily fixed.

Aside from compromising the BackupPC server itself, exploitation of
the above six vulnerabilities would be challenging but potentially
doable if an attacker had say unfettered access to a compromised host
on the same network as the BackupPC server.  I think it should be
straightforward to port the upstream fixes to the most recently
released rsync-bpc versions (3.1.3.2 and 3.1.2.3) and I'll be working
on that until further notice.  I'll keep the list updated on progress.

-- 

73,
Ged.


_______________________________________________
BackupPC-users mailing list
[email protected]
List:    https://lists.sourceforge.net/lists/listinfo/backuppc-users
Wiki:    https://github.com/backuppc/backuppc/wiki
Project: https://backuppc.github.io/backuppc/