Critical Security Update for Git LFS: Addressing Stack Exhaustion Vulnerability
Summary
ALSA-2024:7136: Important: git-lfs security update. Affects git-lfs versions < 3.4.1-4.el9_4. Fixed in 3.4.1-4.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is essential for developers working with large assets, ensuring that repositories remain lightweight and manageable. However, vulnerabilities in Git LFS can pose significant risks, potentially leading to application crashes or data loss.
Vulnerability Detail
The vulnerability identified in Git LFS is related to the encoding/gob package in Go, specifically concerning the Decoder.Decode function. When this function is called on a message containing deeply nested structures, it can lead to a panic due to stack exhaustion. This issue, cataloged as CVE-2024-34156, can result in application instability and may allow an attacker to exploit the vulnerability to cause a denial of service by crashing the application.
How To Fix
Minimum fixed version
3.4.1-4.el9_4
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using deeply nested structures in their messages when utilizing the Decoder.Decode function. However, this is not a permanent solution and updating to the fixed version is strongly recommended.
Conclusion
The identified vulnerability in Git LFS poses significant risks to application stability due to stack exhaustion issues. Users are strongly advised to update to the latest version to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers, while the actual files are stored on a remote server.
CVE-2024-34156 refers to a specific vulnerability in Git LFS that can cause a panic due to stack exhaustion when decoding deeply nested structures.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
The primary risk is application instability, which can lead to crashes and potential denial of service, affecting the availability of your application.
While avoiding deeply nested structures can serve as a temporary workaround, the best course of action is to update Git LFS to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
