Source Code Security Audit of Git — Critical Vulnerabilities Discovered

guest · Jan 17, 2023

Git patches two critical remote code execution security flaws
By Sergiu Gatlan @serghei - January 17, 2023

Git has patched two critical severity security vulnerabilities that could allow attackers to execute arbitrary code after successfully exploiting heap-based buffer overflow weaknesses.
Click to expand...

A third Windows-specific flaw impacting the Git GUI tool caused by an untrusted search path weakness enables unauthenticated threat actors to run untrusted code low-complexity attacks.

The first two vulnerabilities (CVE-2022-41903 in the commit formatting mechanism and CVE-2022-23521 in the .gitattributes parser) were patched on Wednesday in new versions going back to v2.30.7.
The third one, tracked as CVE-2022-41953, is still waiting for a patch, but users can work around the issue by not using the Git GUI software to clone repositories or avoid cloning from untrusted sources.
Click to expand...

Security experts from X41 (Eric Sesterhenn and Markus Vervier) and GitLab (Joern Schneeweisz) found these vulnerabilities as part of a security source code audit of Git sponsored by OSTIF.

"The most severe issue discovered allows an attacker to trigger a heap-based memory corruption during clone or pull operations, which might result in code execution. Another critical issue allows code execution during an archive operation, which is commonly performed by Git forges," X41 security experts said.
Click to expand...

In all cases, the most effective way to defend against attacks attempting to exploit these vulnerabilities is to upgrade to the latest Git release (v2.39.1).
Click to expand...

X41: Security Audit of Git

The OSTIF sponsored a security source code audit of Git, which was performed by a team of security experts from X41 and GitLab, who sponsored the time of Joern Schneeweisz and Patrick Steinhardt to collaborate with the X41 team. Additionally, supply chain and static code analysis audits are currently being performed.

The full report of this audit can be found here:

https://www.x41-dsec.de/static/reports/X41-OSTIF-Gitlab-Git-Security-Audit-20230117-public.pdf

https://github.com/git/git/files/10430260/X41-OSTIF-Gitlab-Git-Security-Audit-20230117-public.pdf

Click to expand...

A blog post from the OSTIF about their efforts to secure Git and ongoing audits can be found here. The announcement for the two critical issues found in this audit is available at OSS Security.
Click to expand...

OSTIF: The Audit of Git is Complete!

January 17, 2023
Results of Git Security Audit
For this portion of the research a total of 35 issues were discovered, including 2 critical severity findings and a high severity finding. Additionally, because of this research, a number of potentially catastrophic security bugs were discovered and resolved internally by the git security team. (A special thank you to Patrick Steinhardt for all of their work on the formatting issues related to CVE-2022-41903).

The serious bug fixes are in the latest release of Git (released today).
Click to expand...

Log in or Sign up

Source Code Security Audit of Git — Critical Vulnerabilities Discovered

guest Guest

Log in or Sign up

Source Code Security Audit of Git — Critical Vulnerabilities Discovered

guest Guest

Useful Searches