Bugzilla – Bug 1219660
VUL-0: CVE-2024-24577: git,libgit2: arbitrary code execution due to heap corruption in git_index_add
Last modified: 2024-07-18 21:30:03 UTC
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24577 https://github.com/libgit2/libgit2/releases/tag/v1.6.5 https://github.com/libgit2/libgit2/releases/tag/v1.7.2 https://www.cve.org/CVERecord?id=CVE-2024-24577 https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8 https://bugzilla.redhat.com/show_bug.cgi?id=2263095
Fix: https://github.com/libgit2/libgit2/commit/487af0cf6687dc48b0a960fa2f39894e2d84d77b
https://build.opensuse.org/request/show/1144998
libgit2 affected everywhere. git has it in read-cache.c, and it looks similar affected in 2.25.2 in SLE12. also 2.43.0 still looks affected in SLE15 SP6.
camila.matos@suse.com set the needinfo flag on me, and I assume this was done in combination with a comment marked private. (There are 5 private comments before bug 1219664 comment #3) If you wish to engage with a volunteer community member, feel free to do so with public comments. If this is for anything other than openSUSE, through, please contact the SUSE bug assignee or the SUSE Product Security team.
(In reply to Andreas Stieger from comment #10) > camila.matos@suse.com set the needinfo flag on me, and I assume this was > done in combination with a comment marked private. (There are 5 private > comments before bug 1219664 comment #3) If you wish to engage with a > volunteer community member, feel free to do so with public comments. If this > is for anything other than openSUSE, through, please contact the SUSE bug > assignee or the SUSE Product Security team. My apologies, it was my mistake. There is no need to worry about the original needinfo request, as I have already adjusted it. Thanks for the answer!
Scott B. - can you take this one for the libgit2 update. For SLE-15-SP6 the update to 1.7.2 needed for 1219664 will cover this. For the other products a backport will likely be necessary.