# Mitigating a rsync Vulnerability: A Lesson in Compiler Hardening

DevFeed: [Mitigating a rsync Vulnerability: A Lesson in Compiler Hardening](<https://devfeed.tech/articles/mitigating-a-rsync-vulnerability-a-lesson-in-compiler-hardening-13161.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/mitigating-a-rsync-vulnerability-a-lesson-in-compiler-hardening>)

Published: 2025-03-19T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Compiler](<https://devfeed.tech/topics/compiler.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Security](<https://devfeed.tech/topics/security.md>), [c/c++](<https://devfeed.tech/topics/c-c-plus-plus.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>)

Tags: [c](<https://devfeed.tech/tags/c.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [compiler-flags](<https://devfeed.tech/tags/compiler-flags.md>), [compiler-hardening](<https://devfeed.tech/tags/compiler-hardening.md>), [cves](<https://devfeed.tech/tags/cves.md>), [defense-in-depth](<https://devfeed.tech/tags/defense-in-depth.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [linux](<https://devfeed.tech/tags/linux.md>), [llvm](<https://devfeed.tech/tags/llvm.md>), [product-security](<https://devfeed.tech/tags/product-security.md>), [rsync](<https://devfeed.tech/tags/rsync.md>), [security](<https://devfeed.tech/tags/security.md>), [x86-64](<https://devfeed.tech/tags/x86-64.md>)

## AI overview

Chainguard describes how compiler hardening in its C/C++ toolchain helped protect against an rsync vulnerability before public disclosure. The article presents compiler hardening flags as layers of defense for memory-unsafe software and discusses Chainguard's implementation of recommendations from OpenSSF and GCC.

## Source excerpt

Chainguard's defense-in-depth security strategy protected against multiple rsync CVEs before they were even reported. See how we did it, using compiler flags.