Corrective releases of the distributed version control system Git 2.35.2, 2.30.3, 2.31.2, 2.32.1, 2.33.2, and 2.34.2 have been published, addressing two vulnerabilities:
- CVE-2022-24765 — a vulnerability was identified on multi-user systems with shared directories that allows for an attack leading to the execution of commands defined by another user. An attacker can create a '.git' directory in locations that intersect with other users (for example, in shared directories or directories with temporary files) and place a configuration file '.git/config' in it with settings for handlers that are invoked when executing certain git commands (for example, the core.fsmonitor parameter can be used to trigger code execution).
Handlers defined in '.git/config' will be executed with the privileges of another user if that user runs git in a directory located one level above the subdirectory '.git' created by the attacker. The call can also be made indirectly, for example, through the use of code editors with git support like VS Code and Atom, or through add-ons that invoke 'git status' (for instance, Git Bash or posh-git). In Git version 2.35.2, the vulnerability is blocked by changes in the logic for finding '.git' in lower directories (the '.git' directory is no longer considered if it belongs to another user).
- CVE-2022-24767 — a Windows-specific vulnerability that allows for code execution with SYSTEM privileges during the uninstallation (Uninstall) of Git for Windows. This issue arises from the fact that the uninstaller runs in a temporary directory writable by system users. The attack is carried out by placing replacement DLLs in the temporary directory that will be loaded when the uninstaller is executed with SYSTEM privileges.
Source: opennet.ru
