Bug 2263092 (CVE-2024-24575)

Summary:	CVE-2024-24575 libgit2: potential infiniate loop condition in git_revparse_single
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bodavis, emachado, ganandan, jcajka, jchecahi, jistone, mnewsome, sipoyare, tstellar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libgit2 1.6.5, libgit2 1.7.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in libgit2, a cross-platform, linkable library implementation of Git. This flaw allows an attacker using a specially-crafted payload to `git_revparse_single` and cause the function to enter an infinite loop. This issue potentially causes a denial of service attack in the calling application.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2263101, 2263102, 2263103, 2263104, 2263105
Bug Blocks:	2263090

Description Robb Gatica 2024-02-07 00:15:17 UTC

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2.

https://github.com/libgit2/libgit2/commit/add2dabb3c16aa49b33904dcdc07cd915efc12fa
https://github.com/libgit2/libgit2/releases/tag/v1.6.5
https://github.com/libgit2/libgit2/releases/tag/v1.7.2
https://github.com/libgit2/libgit2/security/advisories/GHSA-54mf-x2rh-hq9v

Comment 1 Robb Gatica 2024-02-07 00:53:14 UTC

Created libgit2 tracking bugs for this issue:

Affects: fedora-all [bug 2263101]


Created rust tracking bugs for this issue:

Affects: epel-all [bug 2263103]
Affects: fedora-all [bug 2263104]


Created rust-libgit2-sys tracking bugs for this issue:

Affects: fedora-all [bug 2263105]