Log in Start free

Vulnerability · Published Feb 6, 2024 · Assigned by GitHub_M

CVE-2024-24577libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`

High 8.6

In plain English

A high-severity heap buffer overflow in libgit2 from libgit2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)1.5%top 24.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20eza0.18.2-r0ALPINE-CVE-2024-24577
Alpine:v3.21eza0.18.2-r0ALPINE-CVE-2024-24577
Alpine:v3.22eza0.18.2-r0ALPINE-CVE-2024-24577
Alpine:v3.23eza0.18.2-r0ALPINE-CVE-2024-24577
Alpine:v3.24eza0.18.2-r0ALPINE-CVE-2024-24577
Alpine:v3.20libgit21.7.2-r0ALPINE-CVE-2024-24577
Alpine:v3.21libgit21.7.2-r0ALPINE-CVE-2024-24577
Alpine:v3.22libgit21.7.2-r0ALPINE-CVE-2024-24577
Alpine:v3.23libgit21.7.2-r0ALPINE-CVE-2024-24577
Alpine:v3.24libgit21.7.2-r0ALPINE-CVE-2024-24577
Debian:12libgit21.5.1+ds-1+deb12u1DSA-5619-1
Debian:12libgit21.5.1+ds-1+deb12u1DEBIAN-CVE-2024-24577
Debian:13libgit21.7.2+ds-1DEBIAN-CVE-2024-24577
Debian:14libgit21.7.2+ds-1DEBIAN-CVE-2024-24577
Ubuntu:22.04:LTSlibgit21.1.0+dfsg.1-4.1ubuntu0.1UBUNTU-CVE-2024-24577
Ubuntu:22.04:LTSlibgit21.1.0+dfsg.1-4.1ubuntu0.1USN-6678-1

Affected products (as reported)

VendorProductVersions
libgit2 libgit2 < 1.6.5>= 1.7.0, < 1.7.2

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References