Heap Corruption Vulnerability in libgit2: Potential for Arbitrary Code Execution
Summary
UBUNTU-CVE-2024-24577: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Affects libgit2 versions 0.19.0-2 – 0.19.0-2ubuntu0.4+esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is a portable C implementation of the Git core methods, designed to provide a linkable library with a robust API for integrating Git functionality into applications. It is widely used due to its efficiency and flexibility in handling Git operations. However, it is susceptible to vulnerabilities that can lead to severe security risks, including arbitrary code execution.
Vulnerability Detail
The vulnerability arises from a flaw in the has_dir_name function within the src/libgit2/index.c file, where an entry is incorrectly freed. This freed entry is subsequently reused and overwritten with potentially malicious data, leading to heap corruption. If exploited, this could allow an attacker to execute arbitrary code within the context of the application using libgit2. The vulnerability has been assigned a CVSS score of 8.6, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the git_index_add function with untrusted inputs until the package is updated. This can help mitigate the risk of exploitation while a permanent fix is being implemented.
Conclusion
The libgit2 vulnerability presents a significant risk due to the potential for arbitrary code execution through heap corruption. It is crucial for users to update to the patched versions of the library to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for libgit2 →
FAQ
libgit2 is a C library that implements the core methods of Git, allowing developers to integrate Git functionalities into their applications.
An attacker can exploit this vulnerability by crafting specific inputs to the git_index_add function, leading to heap corruption and potential arbitrary code execution.
Exploitation of this vulnerability can lead to unauthorized access, data corruption, or complete control over the affected application.
Yes, the vulnerability has been patched in versions 1.6.5 and 1.7.2 of libgit2. Users are advised to update to these versions or later.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code or install anything.
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
