A critical vulnerability in Git (CVE-2021-29468) has been identified, manifesting only when compiled for the Cygwin environment (a library for emulating the basic Linux API on Windows and a set of standard Linux programs for Windows). The vulnerability allows an attacker to execute code when retrieving data ('git checkout') from a repository controlled by the attacker. The issue has been fixed in the git package 2.31.1-2 for Cygwin. The main Git project has not yet resolved this issue (it is unlikely that anyone compiles git for Cygwin manually, as opposed to using a pre-built package).
The vulnerability arises from treating the Cygwin environment as a Unix-like system rather than Windows, leading to a lack of restrictions on the use of the '\' character in paths, while in Cygwin, as well as in Windows, this character can be used to separate directories. Consequently, by creating a specially modified repository containing symbolic links and files with the backslash character, an attacker can achieve arbitrary file overwriting when loading this repository in Cygwin (a similar vulnerability in Git for Windows was fixed in 2019). With the ability to overwrite files, the attacker can override hook calls in git and achieve the execution of arbitrary code on the system.
Source: opennet.ru
