CVE-2017-16548

What it actually does

Missing null terminator validation in receive_xattr allows a remote attacker to trigger a heap buffer over-read when processing a crafted extended attribute name over the rsync protocol.

Why it matters to the business

Unpatched rsync instances in container or orchestration images can experience crashes or memory disclosure, leading to service outages for synchronization jobs and potential exposure of sensitive file metadata across many dependent deployments.

How an attack unfolds

An unauthenticated attacker connects to an rsync daemon, crafts an xattr name lacking a trailing null byte inside the attribute payload, and sends it during the receive phase to induce the over-read condition and application crash or further memory corruption.

How to fix it

Upgrade nri-kubernetes-2.13 and nri-kubernetes-2.13-compat to version 2.13.15-r1 or later; rebuild and redeploy all affected container images containing the vulnerable rsync component.

How to confirm the fix worked

Confirm rsync binary or library version inside rebuilt images matches or exceeds the fixed release; run protocol fuzzing or static analysis targeting receive_xattr to verify the null check is present.

Typical attack path

1. Establish TCP connection to rsync daemon on default or configured port
2. Initiate file transfer or list operation that triggers xattr handling
3. Transmit malformed extended attribute name without terminating null byte
4. Trigger receive_xattr processing to cause heap over-read and crash

How to detect it

Review rsync daemon logs for sudden crashes or malformed attribute handling around the time of file transfer attempts; inspect core dumps or memory traces for patterns consistent with xattr buffer over-reads.

What your security team should do

• Immediately update all Chainguard nri-kubernetes images to the stated fixed versions
• Scan container registries and build pipelines for any remaining references to vulnerable rsync versions
• Add rsync daemon exposure to network segmentation and monitoring rules until patches are applied