Description

rsync tbefore 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an empty response for a uid or gid lookup, rsync incorrectly interprets it as a successful resolution to uid/gid 0 (root) rather than a lookup failure, and if the name-converter also signals fake super-user status, rsync proceeds with root ownership assignments for transferred files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T15:19:51.947Z",
  "pubdate": "2026-08-13T15:19:51.947Z",
  "executiveSummary": "A privilege confusion vulnerability exists in rsync prior to version 3.5.0, specifically within the name-converter subprocess uid and gid mapping mechanism. The flaw allows local attackers to manipulate transferred files into being owned by the root user by influencing name-converter responses to return empty values.\nThe vulnerability type is classified as a privilege confusion and improper access control issue. The impact allows local threat actors to escalate file ownership privileges during synchronization operations, potentially leading to unauthorized control over critical system files.\nAffected systems include deployments utilizing rsync versions before 3.5.0 where name-converter subprocesses handle user and group identifier mappings. The risk implications are significant for multi-tenant or shared environments where local users can interact with rsync synchronization processes.\nAttacker capabilities require local access to the system to influence name-converter subprocess responses. Exploitation requirements rely on the attacker's ability to cause the name-converter to return empty values for uid or gid lookups while simultaneously signaling a fake super-user status.",
  "technicalDetails": "The vulnerability resides in the name-converter subprocess component of rsync, specifically within the uid and gid mapping logic. The affected versions comprise all rsync builds prior to 3.5.0. The root cause of the vulnerability stems from improper error handling and state interpretation during user and group identifier resolution processes.\nWhen the name-converter subprocess encounters a lookup scenario and returns an empty response for a requested uid or gid, rsync fails to recognize this occurrence as a standard lookup failure. Instead, the application incorrectly interprets the empty response as a successful resolution mapping directly to uid or gid 0, which corresponds to the root user.\nThe attack flow proceeds as follows: First, a local attacker positions themselves to influence or intercept the responses generated by the name-converter subprocess during a file transfer operation. Second, the attacker crafts conditions causing the name-converter to return an empty response for specific uid or gid lookup requests. Third, the name-converter subprocess simultaneously signals a fake super-user status to the main rsync process.\nUpon receiving the empty lookup response combined with the signaled super-user status, rsync proceeds to assign root ownership to the transferred files. The application bypasses expected validation checks because the fallback default resolution maps to zero rather than triggering an abort or a failure state.\nAuthentication and privilege requirements involve local execution capabilities. The attacker must possess local access to manipulate or influence subprocess communication within the context of the running rsync operation. Network exposure is not strictly required as the vulnerability is driven by local process interaction and subprocess parsing logic.\nThe post-exploitation impact allows local attackers to force arbitrary file ownership assignments to the root user upon transfer completion. This unauthorized ownership manipulation can be leveraged to compromise system integrity, bypass discretionary access controls, and facilitate subsequent privilege escalation vectors within the local operating system environment."
}