Log in Start free

Vulnerability · Published Feb 6, 2024 · Assigned by GitHub_M

CVE-2024-24575libgit2 is vulnerable to a denial of service attack in `git_revparse_single`

High 7.5

In plain English

A high-severity uncontrolled resource consumption in libgit2 from libgit2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.4%top 26.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20libgit21.7.2-r0ALPINE-CVE-2024-24575
Alpine:v3.21libgit21.7.2-r0ALPINE-CVE-2024-24575
Alpine:v3.22libgit21.7.2-r0ALPINE-CVE-2024-24575
Alpine:v3.23libgit21.7.2-r0ALPINE-CVE-2024-24575
Alpine:v3.24libgit21.7.2-r0ALPINE-CVE-2024-24575
Debian:12libgit21.5.1+ds-1+deb12u1DEBIAN-CVE-2024-24575
Debian:13libgit21.7.2+ds-1DEBIAN-CVE-2024-24575
Debian:14libgit21.7.2+ds-1DEBIAN-CVE-2024-24575

Affected products (as reported)

VendorProductVersions
libgit2 libgit2 >= 1.4.0, < 1.6.5>= 1.7.0, < 1.7.2

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References