Corrective releases of the distributed version control system Git 2.39.1, 2.38.3, 2.37.5, 2.36.4, 2.35.6, 2.34.6, 2.33.6, 2.32.5, 2.31.6, and 2.30.7 have been published, addressing two vulnerabilities that allow for the execution of arbitrary code on a user's system when using the 'git archive' command and interacting with untrusted external repositories. The vulnerabilities stem from errors in formatting commit codes and parsing the '.gitattributes' file, which can lead to writing outside the heap memory and reading arbitrary data from memory when processing external repositories.
Both vulnerabilities were identified during a security audit of the Git codebase carried out by X41 at the request of the OSTIF (Open Source Technology Improvement Fund), established to enhance the security of open-source projects. In addition to the two critical issues discussed below, the audit also identified one dangerous vulnerability, one medium-severity vulnerability, and four non-critical issues. Additionally, 27 recommendations for improving the security of the codebase were provided.
- CVE-2022-41903: An integer overflow in the commit information formatting code, which occurs when processing large offset values in padding operators such as '%<( ', '%(', '%>>( ', and '%><('. The integer overflow arises in the format_and_pad_commit() function due to the use of the int type for the size_t variable, which participates in determining the size of the copied block during the memcpy() call.
The vulnerability manifests both through direct calls with specially crafted formatting parameters (for instance, when running 'git log --format=…'), and through indirect application of formatting during the execution of the 'git archive' command in a repository controlled by the attacker. In the latter case, formatting modifiers are set via the export-subst parameter in the '.gitattributes' file, which can be placed by the attacker in their own repository. This issue can be exploited to read and write arbitrary areas in the heap, leading to the execution of malicious code when working with unverified repositories.
- CVE-2022-23521: Integer overflows when parsing the contents of '.gitattributes' files in a repository, manifesting during the processing of a very large number of file path patterns or a large number of attributes with a single pattern, as well as when parsing very large attribute names. This issue can be exploited to read and write arbitrary areas in memory, leading to the execution of malicious code when working with an untrusted repository where an attacker can place a specially crafted .gitattributes file and ensure it gets indexed.
Updates for packages in distributions can be tracked on the following pages: Debian, Ubuntu, Gentoo, RHEL, SUSE, Arch, FreeBSD, NetBSD. To reduce the risk of an attack when timely updates cannot be applied, it is advisable to refrain from working with untrustworthy repositories and from using the ‘git archive’ command. It is important to remember that the ‘git archive’ command can be invoked implicitly, for example, from git daemon. To disable the execution of ‘git archive’ in git daemon, change the daemon.uploadArch setting using the command ‘git config —global daemon.uploadArch false’.
Additionally, another vulnerability (CVE-2022-41953) in the Git for Windows product can lead to code execution when cloning unverified external repositories via the graphical interface. This issue is caused by the fact that Git GUI for Windows automatically executes certain post-processing commands, such as running the spell-check program after the ‘checkout’ operation, while the spell-check file search paths encompass the cloned working tree (the attack involves adding spell-check to the repository's working tree).
Source: opennet.ru
