Corrective releases of the distributed version control system Git 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4 have been published, addressing five vulnerabilities. The most serious vulnerability (CVE-2024-32002), rated critical, allows an attacker to execute arbitrary code when cloning a repository controlled by the attacker using the 'git clone' command.
The vulnerability occurs only in case-insensitive file systems that support symbolic links, such as those used by default in Windows and macOS. Exploitation is achieved by creating a submodule directory and a symbolic link that differ only in case, allowing files to be written to the .git/ directory instead of the working directory of the submodule. By gaining write access to .git/, an attacker can override hook calls through .git/hooks and execute arbitrary code during the 'git clone' operation.
Other vulnerabilities:
- CVE-2024-32004 — an attacker in a multi-user system can prepare a specially formatted local repository and cause code execution when it is cloned. Specifically, the attacker can create a local repository that appears to be a partial clone, missing a specific object. Cloning this repository will result in code execution with the privileges of the user performing the clone operation.
- CVE-2024-32465 — cloning from zip archives containing a full git repository, including hooks in the .git/ directory, will lead to the execution of those hooks.
- CVE-2024-32020 — creating local clones of a repository on the same disk in a multi-user system allows other users to modify files that use hard links.
- CVE-2024-32021 — cloning a local repository with symbolic links can be used to create hard links to arbitrary files in the objects/ directory.
In addition to addressing vulnerabilities in new versions, several changes aimed at enhancing protection against vulnerabilities that lead to remote code execution and that manipulate symbolic links during cloning have been proposed. For instance, git now issues a warning when symbolic links are present in the .git/ directory. Paths to submodules can now only contain real directories. When encountering symbolic links and directories, directories are processed. When executing 'git clone', protection against hook execution during cloning has been added, and checks for the core.hooksPath parameter have been strengthened.
Source: opennet.ru
