Bug 2280421 (CVE-2024-32002)

Summary: CVE-2024-32002 git: Recursive clones RCE
Product: [Other] Security Response Reporter: Nick Tait <ntait>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aprice, bdettelb, caswilli, chazlett, dfreiber, dkuc, drow, fjansen, gmalinko, hhorak, hkataria, janstey, jburrell, jmitchel, jorton, jsamir, jsherril, jtanner, kaycoth, kshier, mpierce, opohorel, orabin, pdelbell, pdwyer, rstepani, sidakwo, vkumar, vondruch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: git 2.45.1, git 2.44.1, git 2.43.4, git 2.42.2, git 2.41.1 , git 2.40.2, git 2.39.4 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Git. This vulnerability allows the malicious manipulation of repositories containing submodules, exploiting a bug that enables the writing of files into the .git/ directory instead of the submodule's intended worktree. This manipulation facilitates the execution of arbitrary code during the cloning process, bypassing user inspection and control.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2280426, 2280422, 2280423, 2280424, 2280425, 2280427    
Bug Blocks: 2280416    

Description Nick Tait 2024-05-14 23:10:40 UTC
Repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a .git/ directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed.

Comment 1 Nick Tait 2024-05-14 23:10:57 UTC
Created git tracking bugs for this issue:

Affects: fedora-all [bug 2280422]

Comment 4 Nick Tait 2024-05-14 23:17:11 UTC
Created rubygem-dynect_rest tracking bugs for this issue:

Affects: epel-all [bug 2280423]


Created rubygem-rouge tracking bugs for this issue:

Affects: fedora-all [bug 2280424]


Created rubygem-stringex tracking bugs for this issue:

Affects: fedora-all [bug 2280425]


Created swiftlint tracking bugs for this issue:

Affects: fedora-all [bug 2280426]

Comment 11 Vít Ondruch 2024-06-17 08:43:32 UTC
Just reading the GH announcement [1], the heading states "Recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution". It is interesting that the "case-insensitive filesystems" is not mentioned anywhere here. To me this means that most Linux systems are not affected, which might be interesting information for RH users.



[1]: https://github.blog/2024-05-14-securing-git-addressing-5-new-vulnerabilities/#recursive-clones-on-case-insensitive-filesystems-that-support-symlinks-are-susceptible-to-remote-code-execution-cve-2024-32002-critical

Comment 12 errata-xmlrpc 2024-06-25 08:18:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:4084 https://access.redhat.com/errata/RHSA-2024:4084

Comment 13 errata-xmlrpc 2024-06-25 08:24:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4083 https://access.redhat.com/errata/RHSA-2024:4083

Comment 15 errata-xmlrpc 2024-07-08 11:21:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:4368 https://access.redhat.com/errata/RHSA-2024:4368

Comment 16 errata-xmlrpc 2024-07-16 19:30:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:4579 https://access.redhat.com/errata/RHSA-2024:4579

Comment 17 errata-xmlrpc 2024-08-29 11:27:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2024:6028 https://access.redhat.com/errata/RHSA-2024:6028

Comment 18 errata-xmlrpc 2024-08-29 11:33:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:6027 https://access.redhat.com/errata/RHSA-2024:6027

Comment 19 errata-xmlrpc 2024-09-11 18:07:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:6610 https://access.redhat.com/errata/RHSA-2024:6610