A new set of Git releases were published to address a variety of security vulnerabilities. All users are encouraged to upgrade. Take a look at GitHub’s view of the latest round of releases.
Today, the Git project released new versions to address a pair of security vulnerabilities, CVE-2023-25652 and CVE-2023-29007, that affect versions 2.40.0 and older.
Git was also patched to address additional, Windows-specific vulnerabilities: CVE-2023-25815, CVE-2023-29011, and CVE-2023-29012. The Git for Windows project released new versions including the fixes for all five of these vulnerabilities.
To protect against CVE-2023-25652 and CVE-2023-29007, users are encouraged to upgrade immediately. The former may be used to perform controlled content writes at arbitrary paths with git apply --reject. The latter may be used to inject arbitrary configuration settings, which may in turn be used to achieve arbitrary code execution.
The Windows-specific issues affect users on multi-user machines, users working in Git CMD, and users leveraging the SOCKS5 proxy connect.exe that is included in the Git for Windows distribution. Users fitting any of these descriptions are also encouraged to upgrade immediately.
When applying patches with git apply, Git rejects inputs that attempt to write a file beyond a symbolic link. In Git 2.39.1, this mechanism was updated to reject patches which themselves created symbolic links and attempted to write beyond them.
However, this fix was incomplete: when using git apply --reject to write out rejected hunks from the patch as *.rej files, specially crafted malicious patches can perform controlled content writes at arbitrary locations.
[source]
Git’s implementation used to rename or delete sections of a configuration file contained a logic error that resulted in improperly treating configuration values longer than a fixed length as containing new sections.
This can result in arbitrary configuration injection into a user’s $GIT_DIR/config when attempting to rename or remove a malicious configuration section. This may be used to achieve arbitrary code execution, via configuration values that specify executables, such as core.pager, core.editor, core.sshCommand, and so on.
This vulnerability may be exploited by using overly-long submodule URLs, which are stored in a user’s $GIT_DIR/config upon initialization. Those URLs may be misinterpreted as containing new configuration material when removing those sections, for example, with git submodule deinit.
[source]
A recent change in one of the packages shipped with Git for Windows caused the gettext() function to use the hard-coded path C:\mingw64\share\locale when looking for localization messages instead of respecting the runtime prefix.
Using obscure message formatting features, this allows out-of-bound memory writes, which can be used to cause crashes.
This vulnerability affects users working on Windows machines to which other, untrusted parties have write access. Typically, all authenticated users have permission to create folders in C:\, allowing for malicious actors to inject incorrect messages into git.exe.
[source]
A similar vulnerability (as above) exists in Git for Windows’s connect.exe executable, which is responsible for implementing a SOCKS5 proxy.
The location of connect.exe’s configuration file is hard-coded to a path that is typically interpreted as C:\etc\connectrc, which is susceptible in a similar fashion as above. Users on multi-account Windows machines are highly advised to exercise caution if they use this SOCKS5 proxy on those machines.
[source]
Lastly, Git for Windows’s “Git CMD” program incorrectly searches for a program called doskey.exe beginning in the working directory of Git CMD on startup. When started in untrusted directories, this can lead to silent arbitrary code execution.
This vulnerability is similar to the one that led to Git CMD being deprecated temporarily in Git for Windows v2.19.2, but is contained to the directory in which Git CMD is started.
[source]
The most effective way to protect against these vulnerabilities is to upgrade to Git 2.40.1. If you can’t update immediately, reduce your risk by taking the following steps:
Taylor Blau git apply --reject when working with patches from untrusted sources. Use git apply --stat to inspect a patch before applying it.git submodule deinit, git config --rename-section, and git config --remove-section on untrusted repositories or without prior inspection of your $GIT_DIR/config.On Windows, you can reduce your risk by doing the following:
C:\mingw64 and C:\etc folders, and remove any write permission on them.In order to protect users against these attacks, GitHub has taken proactive steps. Specifically, we:
GitHub itself is not affected by these vulnerabilities. We do not use git apply --reject, nor Git’s configuration mechanism. GitHub does not use Git for Windows, and is thus not affected by those vulnerabilities, either.
CVE-2023-25652 was found by RyotaK, and CVE-2023-29007 was found by André Baptista and Vítor Pinho of Ethiack. The fixes for CVE-2023-25652 were developed by Johannes Schindelin, Taylor Blau, and Junio C Hamano, with help from Linus Torvalds. The fixes for CVE-2023-29007 were developed by Taylor Blau, Jeff King, Patrick Steinhardt, and Johannes Schindelin.
CVE-2023-25815 was discovered by Maxime Escourbiac and Cousky. Both CVE-2023-29011 and CVE-2023-29012 were discovered by ycdxsb. Fixes for all three of these vulnerabilities were developed by Johannes Schindelin.
This blog post is an in-depth walkthrough on how we perform security research leveraging GitHub features, including code scanning, CodeQL, and Codespaces.
A discussion about how tech is aiding organizations fighting for gender equality, what it means to be a woman in tech and the world today, and advice on how we all move forward.
Game Bytes is our monthly series taking a peek at the world of gamedev on GitHub—featuring game engine updates, game jam details, open source games, mods, maps, and more. Game on!
