Bug 2107439 (CVE-2022-29187)

Summary:	CVE-2022-29187 git: Bypass of safe.directory protections
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amahdal, besser82, caswilli, chazlett, chrisw, dhalasz, dkuc, fjansen, hhorak, jburrell, jkoehler, johannes, jorton, jwong, jwon, kaycoth, kshier, opohorel, pjindal, pstodulk, sbalasub, sebastian.kisela, sthirugn, tmz, vkrizan, vmugicag
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	git 2.30.5, git 2.31.4, git 2.32.3, git 2.33.4, git 2.34.4, git 2.35.4, git 2.36.2, git 2.37.1	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-16 14:48:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2107450, 2107451, 2107452
Bug Blocks:	2107214

Description Sandipan Roy 2022-07-15 04:49:46 UTC

Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765, for example when navigating as root into a shared tmp directory that is owned by them, but where an attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The simplest way to avoid being affected by the exploit described in the example is to avoid running git as root (or an Administrator in Windows), and if needed to reduce its use to a minimum. While a generic workaround is not possible, a system could be hardened from the exploit described in the example by removing any such repository if it exists already and creating one as root to block any future attacks.

https://github.blog/2022-04-12-git-security-vulnerability-announced
https://lore.kernel.org/git/xmqqv8s2fefi.fsf@gitster.g/T/#u
https://github.com/git/git/security/advisories/GHSA-j342-m5hw-rr3v
http://www.openwall.com/lists/oss-security/2022/07/14/1

Comment 1 Sandipan Roy 2022-07-15 05:47:36 UTC

Created git tracking bugs for this issue:

Affects: fedora-all [bug 2107450]

Comment 7 errata-xmlrpc 2023-05-09 07:28:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2319 https://access.redhat.com/errata/RHSA-2023:2319

Comment 8 errata-xmlrpc 2023-05-16 08:20:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2859 https://access.redhat.com/errata/RHSA-2023:2859

Comment 9 Product Security DevOps Team 2023-05-16 14:48:32 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-29187

Comment 10 Red Hat Bugzilla 2023-09-18 04:42:00 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days