Rsync versions before 3.4.3 contain a receiver-side out-of-bounds array read in the recv_files() function. When a malicious rsync server sets the CF_INC_RECURSE flag and sends a file list with a first sorted entry not being the leading "." directory, it causes an index to be set to -1. Subsequently, a transfer record with an invalid index and flags triggers the client to read memory before the allocated pointer array and dereference it in f_name(). This leads to a segmentation fault crash due to accessing unmapped memory in glibc mmap chunk metadata. The vulnerability affects normal recursive pulls without special client options and is limited to denial of service via client crash. The flaw is fixed in rsync 3.4.3.

The vulnerability allows a malicious rsync server to deterministically crash any rsync client that pulls from it, causing a denial of service. There is no impact on confidentiality or integrity, and no known exploitation for code execution. The crash results from an out-of-bounds read leading to a segmentation fault. This affects clients using protocol version 30 or higher with recursive pulls enabled (the default).

This vulnerability is fixed in rsync version 3.4.3. Users should upgrade to version 3.4.3 or later to remediate this issue. Since no official patch or temporary fix is detailed beyond the version update, upgrading is the recommended action. There is no indication that the vulnerability is mitigated by configuration changes or that no action is required.