Critical Security Update for Git LFS: Addressing Stack Exhaustion Vulnerability
Summary
ALSA-2024:7135: Important: git-lfs security update. Affects git-lfs versions < 3.4.1-3.el8_10. Fixed in 3.4.1-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, as it optimizes storage and improves performance. However, vulnerabilities in Git LFS can lead to significant security risks, including potential application crashes and data loss.
Vulnerability Detail
The vulnerability identified in Git LFS is associated with the encoding/gob package in Go, specifically related to the Decoder.Decode function. When this function is called on messages containing deeply nested structures, it can lead to a panic due to stack exhaustion. This issue, cataloged as CVE-2024-34156, poses a risk of application crashes, which can disrupt workflows and lead to data integrity issues. The vulnerability arises from the way nested structures are handled during decoding, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
3.4.1-3.el8_10
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using deeply nested structures in their messages when utilizing the Decoder.Decode function. This may help prevent the panic caused by stack exhaustion until an update can be applied.
Conclusion
The security update for Git LFS addresses a critical vulnerability that can lead to application crashes due to stack exhaustion. Users are urged to update to the latest version to mitigate risks. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files more efficiently by replacing them with text pointers and storing the actual files on a remote server.
CVE-2024-34156 refers to a security vulnerability in Git LFS that can cause a panic due to stack exhaustion when decoding deeply nested structures.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without any installation.
Failing to address this vulnerability can lead to application crashes, data loss, and disruptions in development workflows.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
