Integer Overflow in Git Log and Git Archive
Summary
CVE-2022-41903: Git is distributed revision control system. Affects git across 3 version ranges.
< 2.32.5-r0
< 508386c6c5857b4faa2c3e491f422c98cc69ae76
>= 853373155dce195a91e6e41a58c8b8e5c5a94652, <= 2d2fc8ce733f75f497faabab85c273658c9a5f81
Fixed in 2.32.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a distributed revision control system used for tracking changes in source code during software development. It provides functionality for managing commits, branches, and repositories. The git log command displays commit history in various formats using the --format option. Similarly, git archive allows users to create archives of a Git repository. The export-subst gitattribute enables the use of git log formatting in git archive. This vulnerability affects Git versions prior to 2.30.7.
Vulnerability Detail
The vulnerability, identified as CVE-2022-41903, arises from an integer overflow in the pretty.c::format_and_pad_commit() function. This function is responsible for processing padding operators in commit formatting. Due to improper storage of a size_t as an int, an overflow occurs when the value is added as an offset to a memcpy() call. This integer overflow can be triggered directly by a user running a command that invokes the commit formatting machinery, such as git log --format=.... It can also be triggered indirectly through git archive using the export-subst mechanism. Exploiting this vulnerability can lead to arbitrary heap writes and potential code execution.
How To Fix
Minimum fixed version
2.32.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To disable git archive in untrusted repositories, execute the following command: git config --global daemon.uploadArch false.
Conclusion
In conclusion, the integer overflow vulnerability in Git's git log and git archive functionality can lead to arbitrary heap writes and potential code execution. Users are strongly advised to upgrade their Git installations to a fixed version released on or after January 17, 2023. If upgrading is not possible, disabling git archive in untrusted repositories is recommended. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git →
FAQ
Exploiting this vulnerability can result in arbitrary heap writes and potentially lead to arbitrary code execution.
You can use the Vulert Playground at Vulert Scanner to check if your Git installation is affected by this vulnerability. Simply upload your package-lock.json file to the playground without signing up.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
At the time of this report, there are no known public exploits targeting this vulnerability.
If upgrading Git is not feasible, you can disable git archive in untrusted repositories to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for git.
