CLSA-2026-1789466898
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1789466898.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789466898
- Upstream
- Published
- 2026-09-15T10:08:34Z
- Modified
- 2026-10-26T09:43:56Z
- Summary
- Fix of 7 CVEs
- Details
-
- SECURITY UPDATE: symlink attack on the daemon module-root chdir
- debian/patches/els/0031-CVE-2026-53784.patch: add safe_open_no_attacker_symlinks() in util.c and confine the daemon module-root chdir under use-chroot=no. els/0006 had hardened only the relative branch of change_dir(); the absolute branch was still on a plain chdir(dir)
- CVE-2026-53784
- SECURITY UPDATE: information disclosure and arbitrary write via symlinks
planted on operator-supplied paths
- debian/patches/els/0032-CVE-2026-53802-CVE-2026-53803.patch: open the secrets file, "pid file", --config, motd, --password-file, --log-file, --write-batch/--read-batch and the filter, merge-file, --exclude-from/--include-from paths through safe_open_no_attacker_symlinks()
- debian/patches/els/0037-CVE-2026-53802-files-from.patch: the same for --files-from, which is opened in options.c and which upstream converted separately, in 3ee00e00
- CVE-2026-53802
- CVE-2026-53803
- SECURITY UPDATE: arbitrary file write via an absolute --temp-dir or
--link-dest whose parent is flipped to a symlink mid-operation
- debian/patches/els/0033-CVE-2026-53795.patch: confine do_rename() and do_link() in syscall.c through an ownership walk on the pinned parent directory fd
- debian/patches/els/0039-CVE-2026-53795-exdev.patch: confine the same way the copy_file() opens and the do_unlink() that robust_rename() falls back to when the rename returns EXDEV, i.e. when an absolute --temp-dir or --partial-dir is on another filesystem (upstream bf79a2a0)
- CVE-2026-53795
- These four CVEs were previously assessed as requiring the 3.5.0 path resolution rewrite (54965efc, defd7110, b62d7ed6) and closed Won't Fix. That assessment was wrong for CVE-2026-53784/53802/53803: upstream fixed them on 2026-06-12 in a7c49e93, f2941575, 9bfa07e3 and 62bf55fc, nine days before the rewrite and independent of it. CVE-2026-53795 does depend on the rewrite; els/0033 covers only the two sinks it names and documents what it leaves out
- SECURITY UPDATE: TOCTOU on the non-daemon receiver's destination chdir
- debian/patches/els/0034-CVE-2026-53796.patch: resolve the operator-named destination through safe_open_no_attacker_symlinks() + fchdir, for both the absolute and the relative branch of change_dir()
- CVE-2026-53796
- SECURITY UPDATE: path confinement bypass for a daemon module with a /./
inner boundary marker
- debian/patches/els/0035-CVE-2026-53793.patch: widen the four daemon symlink-confinement gates from "am_daemon && !am_chrooted" to "am_daemon && (!am_chrooted || module_dirlen)" so an inner module root is treated as the trust boundary
- debian/patches/els/0040-CVE-2026-53793-basis-paths.patch: extend that boundary to the two alternate-basis paths the gates do not reach -- the generator's alt-dest basis stat (upstream 5ed0ab3f) and the peer-supplied basis xname the receiver joins to an operator basedir (upstream db284e22)
- CVE-2026-53793
- SECURITY UPDATE: symlink race in the non-daemon sender's source traversal
- debian/patches/els/0036-CVE-2026-53797.patch: open file content through secure_relative_open() anchored at the transfer root under default symlink handling, so a raced parent symlink cannot redirect the read
- debian/patches/els/0038-CVE-2026-53797-noatime.patch: apply O_NOATIME in secure_relative_open() as do_open() did, so --noatime keeps working on that open (and on the els/0006 daemon-sender one)
- CVE-2026-53797
- The three above come from openSUSE's backport of the same upstream commits to rsync 3.2.3 (openSUSE:Leap:15.5:Update/rsync.45907, hardening patches 0108, 0107 and 0100). Four further CVEs from this disclosure remain open against the package and are NOT addressed: CVE-2026-53785, CVE-2026-53801 and CVE-2026-70460 need the 3.5.0 held-dirfd resolver (upstream 3dddbde5; openSUSE 0093/0094/0101 pull in held_dfd_for, link_stat_at, do_mkdir_at and do_chmod_atfd), and CVE-2026-53799 needs the fd-based ACL/xattr family (openSUSE 0118-0124, ~3300 lines incl. libacl and configure work)
- els/0037-0040 answer the code review of GitLab MR secure-libraries/els-os/rsync!30: two of them close real gaps in the patches above (--files-from, the EXDEV fallback), one restores --noatime, and one completes the inner-module boundary. Each is a distinct upstream commit, so each is a distinct patch rather than an edit of the patch it follows
- The upstream regression tests named in the patch headers are not carried: upstream ships them only as pytest testsuite/*_test.py files and 3.1.3 has no pytest harness
- SECURITY UPDATE: symlink attack on the daemon module-root chdir
- References
-
- https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1789466898.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-53784
- https://nvd.nist.gov/vuln/detail/CVE-2026-53793
- https://nvd.nist.gov/vuln/detail/CVE-2026-53795
- https://nvd.nist.gov/vuln/detail/CVE-2026-53796
- https://nvd.nist.gov/vuln/detail/CVE-2026-53797
- https://nvd.nist.gov/vuln/detail/CVE-2026-53802
- https://nvd.nist.gov/vuln/detail/CVE-2026-53803