Bug 2280421 (CVE-2024-32002) - CVE-2024-32002 git: Recursive clones RCE
Summary: CVE-2024-32002 git: Recursive clones RCE
Keywords:
Status: NEW
Alias: CVE-2024-32002
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2280426 2280422 2280423 2280424 2280425 2280427
Blocks: 2280416
TreeView+ depends on / blocked
 
Reported: 2024-05-14 23:10 UTC by Nick Tait
Modified: 2024-09-23 01:18 UTC (History)
29 users (show)

Fixed In Version: git 2.45.1, git 2.44.1, git 2.43.4, git 2.42.2, git 2.41.1 , git 2.40.2, git 2.39.4
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Git. This vulnerability allows the malicious manipulation of repositories containing submodules, exploiting a bug that enables the writing of files into the .git/ directory instead of the submodule's intended worktree. This manipulation facilitates the execution of arbitrary code during the cloning process, bypassing user inspection and control.
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:4093 0 None None None 2024-06-25 11:24:50 UTC
Red Hat Product Errata RHBA-2024:4094 0 None None None 2024-06-25 11:22:51 UTC
Red Hat Product Errata RHBA-2024:4095 0 None None None 2024-06-25 11:24:03 UTC
Red Hat Product Errata RHBA-2024:4096 0 None None None 2024-06-25 11:24:34 UTC
Red Hat Product Errata RHBA-2024:4097 0 None None None 2024-06-25 11:39:55 UTC
Red Hat Product Errata RHBA-2024:4100 0 None None None 2024-06-25 14:35:52 UTC
Red Hat Product Errata RHBA-2024:4130 0 None None None 2024-06-26 14:29:13 UTC
Red Hat Product Errata RHBA-2024:4169 0 None None None 2024-06-27 15:37:32 UTC
Red Hat Product Errata RHBA-2024:4171 0 None None None 2024-06-27 15:42:14 UTC
Red Hat Product Errata RHBA-2024:4180 0 None None None 2024-07-01 01:09:40 UTC
Red Hat Product Errata RHBA-2024:4185 0 None None None 2024-07-01 07:13:05 UTC
Red Hat Product Errata RHBA-2024:4186 0 None None None 2024-07-01 07:23:35 UTC
Red Hat Product Errata RHBA-2024:4380 0 None None None 2024-07-08 14:49:38 UTC
Red Hat Product Errata RHBA-2024:4513 0 None None None 2024-07-11 14:28:53 UTC
Red Hat Product Errata RHBA-2024:6906 0 None None None 2024-09-23 01:18:52 UTC
Red Hat Product Errata RHSA-2024:4083 0 None None None 2024-06-25 08:24:26 UTC
Red Hat Product Errata RHSA-2024:4084 0 None None None 2024-06-25 08:18:43 UTC
Red Hat Product Errata RHSA-2024:4368 0 None None None 2024-07-08 11:21:53 UTC
Red Hat Product Errata RHSA-2024:4579 0 None None None 2024-07-16 19:30:51 UTC
Red Hat Product Errata RHSA-2024:6027 0 None None None 2024-08-29 11:33:08 UTC
Red Hat Product Errata RHSA-2024:6028 0 None None None 2024-08-29 11:27:05 UTC
Red Hat Product Errata RHSA-2024:6610 0 None None None 2024-09-11 18:07:45 UTC

Description Nick Tait 2024-05-14 23:10:40 UTC
Repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a .git/ directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed.

Comment 1 Nick Tait 2024-05-14 23:10:57 UTC
Created git tracking bugs for this issue:

Affects: fedora-all [bug 2280422]

Comment 4 Nick Tait 2024-05-14 23:17:11 UTC
Created rubygem-dynect_rest tracking bugs for this issue:

Affects: epel-all [bug 2280423]


Created rubygem-rouge tracking bugs for this issue:

Affects: fedora-all [bug 2280424]


Created rubygem-stringex tracking bugs for this issue:

Affects: fedora-all [bug 2280425]


Created swiftlint tracking bugs for this issue:

Affects: fedora-all [bug 2280426]

Comment 11 Vít Ondruch 2024-06-17 08:43:32 UTC
Just reading the GH announcement [1], the heading states "Recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution". It is interesting that the "case-insensitive filesystems" is not mentioned anywhere here. To me this means that most Linux systems are not affected, which might be interesting information for RH users.



[1]: https://github.blog/2024-05-14-securing-git-addressing-5-new-vulnerabilities/#recursive-clones-on-case-insensitive-filesystems-that-support-symlinks-are-susceptible-to-remote-code-execution-cve-2024-32002-critical

Comment 12 errata-xmlrpc 2024-06-25 08:18:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:4084 https://access.redhat.com/errata/RHSA-2024:4084

Comment 13 errata-xmlrpc 2024-06-25 08:24:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:4083 https://access.redhat.com/errata/RHSA-2024:4083

Comment 15 errata-xmlrpc 2024-07-08 11:21:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:4368 https://access.redhat.com/errata/RHSA-2024:4368

Comment 16 errata-xmlrpc 2024-07-16 19:30:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:4579 https://access.redhat.com/errata/RHSA-2024:4579

Comment 17 errata-xmlrpc 2024-08-29 11:27:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2024:6028 https://access.redhat.com/errata/RHSA-2024:6028

Comment 18 errata-xmlrpc 2024-08-29 11:33:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:6027 https://access.redhat.com/errata/RHSA-2024:6027

Comment 19 errata-xmlrpc 2024-09-11 18:07:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:6610 https://access.redhat.com/errata/RHSA-2024:6610


Note You need to log in before you can comment on or make changes to this bug.