Vulnerability · Published Apr 12, 2022 · Assigned by GitHub_M
CVE-2022-24765Uncontrolled search for the Git directory in Git for Windows
Medium 6.0
In plain English
A medium-severity uncontrolled search path in git from git-for-windows. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | git | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | git-all | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git-all | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | git-core | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git-core | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | git-core-doc | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git-core-doc | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | git-credential-libsecret | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git-credential-libsecret | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | git-daemon | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git-daemon | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | git-email | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git-email | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | git-gui | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git-gui | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | git-instaweb | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git-instaweb | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | git-subtree | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git-subtree | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | git-svn | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | git-svn | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | gitk | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | gitk | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | gitweb | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | gitweb | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | perl-Git | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | perl-Git | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux:8 | perl-Git-SVN | 2.39.1-1.el8 | ALSA-2023:2859 |
| AlmaLinux:9 | perl-Git-SVN | 2.39.1-1.el9 | ALSA-2023:2319 |
| Alpine:v3.20 | git | 2.35.2-r0 | ALPINE-CVE-2022-24765 |
| Alpine:v3.21 | git | 2.35.2-r0 | ALPINE-CVE-2022-24765 |
| Alpine:v3.22 | git | 2.35.2-r0 | ALPINE-CVE-2022-24765 |
| Alpine:v3.23 | git | 2.35.2-r0 | ALPINE-CVE-2022-24765 |
| Alpine:v3.24 | git | 2.35.2-r0 | ALPINE-CVE-2022-24765 |
| Alpine:v3.20 | libgit2 | 1.4.4-r0 | ALPINE-CVE-2022-24765 |
| Alpine:v3.21 | libgit2 | 1.4.4-r0 | ALPINE-CVE-2022-24765 |
| Alpine:v3.22 | libgit2 | 1.4.4-r0 | ALPINE-CVE-2022-24765 |
| Alpine:v3.23 | libgit2 | 1.4.4-r0 | ALPINE-CVE-2022-24765 |
| Alpine:v3.24 | libgit2 | 1.4.4-r0 | ALPINE-CVE-2022-24765 |
| Debian:12 | git | 1:2.35.2-1 | DEBIAN-CVE-2022-24765 |
| Debian:13 | git | 1:2.35.2-1 | DEBIAN-CVE-2022-24765 |
| Debian:14 | git | 1:2.35.2-1 | DEBIAN-CVE-2022-24765 |
| Ubuntu:22.04:LTS | git | 1:2.34.1-1ubuntu1.2 | UBUNTU-CVE-2022-24765 |
| Ubuntu:22.04:LTS | git | 1:2.34.1-1ubuntu1.1 | USN-5376-2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| git-for-windows | git | < 2.35.2 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2
- https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bash
- https://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScode
- [oss-security] 20220412 git v2.35.2 and friends for CVE-2022-24765 mailing-list
- FEDORA-2022-e99ae504f5 vendor-advisory
- FEDORA-2022-3759ebabd2 vendor-advisory
- FEDORA-2022-2fec5f30be vendor-advisory
- https://support.apple.com/kb/HT213261
- 20220516 APPLE-SA-2022-05-16-8 Xcode 13.4 mailing-list
- FEDORA-2022-dfd7e7fc0e vendor-advisory
- FEDORA-2022-2a5de7cb8b vendor-advisory
- [debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update mailing-list
- FEDORA-2023-470c7ea49e vendor-advisory
- FEDORA-2023-e3c8abd37e vendor-advisory
- FEDORA-2023-1068309389 vendor-advisory
- FEDORA-2023-3ec32f6d4e vendor-advisory
- GLSA-202312-15 vendor-advisory