This vulnerability involves improper handling of length parameters (CWE-130) in the rsync utility used by Samba, specifically in the receive_xattr function. Rsync versions 3.0.1 through 3.4.1 rely on an untrusted length value during a qsort operation, which can lead to a use-after-free vulnerability on the receiver side. The attack vector requires the victim to run rsync with extended attributes enabled (-X). The vulnerability is present on many Linux configurations and more widely on non-Linux platforms. The CVSS 3.1 base score is 7.4, indicating high severity, with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The impact includes potential confidentiality, integrity, and availability losses. No patch or official remediation has been documented as of the published date.

Successful exploitation can lead to use-after-free conditions on the rsync receiver, potentially allowing attackers to execute arbitrary code or cause denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected systems. Exploitation requires the victim to run rsync with the -X option, which limits the attack surface somewhat. The vulnerability is present on many Linux configurations and more broadly on non-Linux platforms.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running rsync with the -X (extended attributes) option if possible, or restrict rsync usage to trusted sources. Monitor vendor channels for updates and apply patches promptly once released.