This vulnerability in rsync (versions 3.0.1 through 3.4.1) arises from improper handling of an untrusted length value during a qsort call in the receive_xattr function, leading to a use-after-free condition. Exploitation requires the victim to run rsync with the -X option to handle extended attributes. The vulnerability affects many Linux configurations and more widely impacts non-Linux platforms. Red Hat has released security advisories and updated packages to fix this issue, specifically providing patched rsync versions for Red Hat Enterprise Linux 6 Extended Lifecycle Support.

Successful exploitation of this vulnerability can lead to use-after-free memory corruption, which may result in partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 7.4 (High), indicating significant risk if exploited. The impact includes potential unauthorized information disclosure, modification, or denial of service due to memory corruption.

Red Hat has released security updates addressing this vulnerability, including patched rsync packages for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Users should apply these official updates to remediate the issue. Since the vulnerability requires running rsync with the -X option, avoiding use of this option can reduce exposure but is not a complete mitigation. Patch status is confirmed by vendor advisories; therefore, applying the vendor-provided updates is the recommended remediation.