Critical RCE vulnerabilities found in git (CVE-2022-41903, CVE-2022-23251)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-41903 +1 in the same advisory: …41953 | Git is distributed revision control system. Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`. NVD description · AI analysis pending | 9.8 group max | 44% |
| — |
Full article531 words · extracted from helpnetsecurity.com · click to collapse
A source code audit has revealed two critical vulnerabilities affecting git, the popular distributed version control system for collaborative software development.
The latest git vulnerabilities
CVE-2022-41903 is an out-of-bounds memory write flaw in log formatting and CVE-2022-23251 is a truncated allocation leading to out-of-bounds write via large number of attributes. Both may result in remote code execution.
More technical info about each of the flaws can be found in this post by X41 D-Sec researchers experts Eric Sesterhenn and Markus Vervier. The two, along with GitLab security engineer Joern Schneeweisz, inspected git’s source code manually and with code analysis and fuzzing tools and uncovered 35 security issues in total.
Aside from the two critical issues, a high severity flaw (CVE-2022-41953) has also been patched in the Git GUI for Windows. This flaw was discovered by 俞晨东.
“The Windows-specific issue involves a $PATH lookup including the current working directory, which can be leveraged to run arbitrary code when cloning repositories with Git GUI,” GitHub software engineer Taylor Blau explained, and advised git users to avoid using the Git GUI on Windows when cloning untrusted repositories.
What should users do?
Windows, macOS and Linux/Unix users are advised to grab and implement the new git releases (v2.39.1).
“If you can’t update immediately, reduce your risk by taking the following steps: Avoid invoking the –format mechanism directly with the known operators, and avoid running git archive in untrusted repositories, and if you expose git archive via git daemon, consider disabling it if working with untrusted repositories by running git config –global daemon.uploadArch false,” Blau advised.
GitLab has also implemented the patches in v15.7.5, 15.6.6, and 15.5.9 of GitLab Community Edition (CE) and Enterprise Edition (EE), and recommends all GitLab installations to be upgraded to one of these versions as soon as possible.
GitHub has implemented mitigation steps to prevent GitHub.com from being used as an attack vector, updated the GitHub Dektop app with patches, and scheduled updates to GitHub Codespaces, GitHub Actions and GitHub Enterprise Server with patched versions of git.
Canonical has released new Ubuntu packages with the latest git version.
Improving git security
The git source code audit was organized by the Open Source Technology Improvement Fund (OSTIF), and other efforts to improve git security are underway, they noted.
“We will be releasing the results of those efforts as each of these projects is completed. This coalition of efforts is unified through our shared interests in git and the critical role that it plays in the open source world,” they added.
“Git is the world’s most widely used version control system, and it underpins not only open source, but the vast majority of public and private software development today. To say that git is infrastructure is an understatement, it reaches nearly every corner of software development and touches nearly every product that has software in one way or another.”
The researchers who performed the audit also offered recommendations for git developers: “The use of safe wrappers can improve the overall security of the software as a short term strategy. As a long term improvement strategy, we recommend to alternate between time-boxed code base refactoring sprints and subsequent security reviews.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/01/19/git-critical-vulnerabilities/