Heap-based buffer overflow in libgit2 - CVE-2024-24577

Vulnerability identifier: #VU86201

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-24577

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in git_index_add. A remote attacker can pass specially crafted filename that starts with a "/" character to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libgit2
Amazon Linux AMI
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Server Module
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Fedora
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Basesystem Module
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
RecoverPoint for Virtual Machines
libgit2-24 (Ubuntu package)
libgit2-26 (Ubuntu package)
rust-pore
rust-strip-ansi-escapes
rust-ansitok
rust-pretty-git-prompt
rust-git-absorb
rust-shadow-rs
rust-cargo-c
rust-vte
rust-vt100
rust-libgit2-sys
rust-git-delta
rust-eza
rust-git2
rust-bat
libgit2-24
libgit2-debugsource
libgit2-24-debuginfo
rust-asyncgit
rust-gitui
libgit2-26
libgit2-26-debuginfo
libgit2
libgit2-devel
libgit2-debuginfo
libgit2-28 (Ubuntu package)
libgit2-28-debuginfo
libgit2-28
rust-lsd
libgit2-1.1 (Ubuntu package)
libgit2 (Debian package)
libgit2-1_3
libgit2-1_3-64bit
libgit2-1_3-64bit-debuginfo
libgit2-1_3-32bit
libgit2-1_3-32bit-debuginfo
libgit2-1_3-debuginfo
libgit2-1.5 (Ubuntu package)
libgit2_1.6
libgit2-1_7
libgit2-tools-debuginfo
libgit2-1_7-debuginfo
libgit2-tools
python-pygit2
rls
rust-debugger-common
rust-src
rust
rust-gdb
rust-lldb
rust-debugsource
clippy
rust-std-static
rustfmt
rust-analysis
rust-debuginfo
cargo
rust-help
rust-analyzer
rust-silver
git-svn
git-email
git-cvs
git-daemon
git-svn-debuginfo
git-daemon-debuginfo
git-core-debuginfo
git-web
git-gui
git-core
gitk
git-doc
git-debugsource
git
git-arch
git-debuginfo
git-credential-gnome-keyring
git-p4
git-credential-libsecret-debuginfo
git-credential-gnome-keyring-debuginfo
git-credential-libsecret
perl-Git
rust-vergen
rust-tokei

Install updates from vendor's website.

libgit2 - addressed in versions 1.6.5, 1.7.2
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
libgit2-24 (Ubuntu package) - update to Ubuntu Pro
libgit2-26 (Ubuntu package) - update to Ubuntu Pro
rust-pore - addressed in versions 0.1.10-3.el9, 0.1.10-3.fc38, 0.1.10-3.fc39, 0.1.10-3.fc40, 0.1.10-3.fc41
rust-strip-ansi-escapes - update to 0.2.0-2.el9
rust-ansitok - update to 0.2.0-4.el9
rust-pretty-git-prompt - addressed in versions 0.2.1-20.fc38, 0.2.1-20.fc39, 0.2.1-20.fc40, 0.2.1-20.fc41
rust-git-absorb - addressed in versions 0.6.11-3.fc38, 0.6.11-3.fc39, 0.6.11-3.fc40, 0.6.11-3.fc41
rust-shadow-rs - addressed in versions 0.8.1-8.el9, 0.8.1-8.fc38, 0.8.1-8.fc39, 0.8.1-8.fc40, 0.8.1-8.fc41
rust-cargo-c - addressed in versions 0.9.27-4.el9, 0.9.28-4.fc38, 0.9.28-4.fc39, 0.9.28-4.fc40, 0.9.28-4.fc41
rust-vte - update to 0.13.0-1.el9
rust-vt100 - update to 0.15.2-2.el9
rust-libgit2-sys - addressed in versions 0.16.2-1.el9, 0.16.2-1.fc38, 0.16.2-1.fc39, 0.16.2-1.fc40, 0.16.2-1.fc41
rust-git-delta - addressed in versions 0.16.5-9.el9, 0.16.5-9.fc38, 0.16.5-9.fc39, 0.16.5-9.fc40, 0.16.5-9.fc41
rust-eza - addressed in versions 0.17.3-2.el9, 0.17.3-2.fc38, 0.17.3-2.fc39, 0.17.3-2.fc40, 0.17.3-2.fc41
rust-git2 - addressed in versions 0.18.2-1.el9, 0.18.2-1.fc38, 0.18.2-1.fc39, 0.18.2-1.fc40, 0.18.2-1.fc41
rust-bat - addressed in versions 0.24.0-2.el9, 0.24.0-3.fc38, 0.24.0-3.fc39, 0.24.0-3.fc40, 0.24.0-3.fc41
libgit2-24 - update to 0.24.1-11.5.1
libgit2-debugsource - addressed in versions 0.24.1-11.5.1, 0.28.4-150200.3.9.1, 1.3.0-150400.3.9.1, 1.7.2-150600.3.3.1
libgit2-24-debuginfo - update to 0.24.1-11.5.1
rust-asyncgit - addressed in versions 0.24.3-3.fc38, 0.24.3-3.fc39, 0.24.3-3.fc40, 0.24.3-3.fc41
rust-gitui - addressed in versions 0.24.3-4.fc38, 0.24.3-4.fc39, 0.24.3-4.fc40, 0.24.3-4.fc41
libgit2-26 - update to 0.26.8-150000.3.21.1
libgit2-26-debuginfo - update to 0.26.8-150000.3.21.1
libgit2 - update to 0.27.8-8
libgit2-debugsource - update to 0.27.8-8
libgit2-devel - update to 0.27.8-8
libgit2-debuginfo - update to 0.27.8-8
libgit2-28 (Ubuntu package) - update to 0.28.4+dfsg.1-2ubuntu0.1
libgit2-28-debuginfo - update to 0.28.4-150200.3.9.1
libgit2-devel - addressed in versions 0.28.4-150200.3.9.1, 1.3.0-150400.3.9.1, 1.7.2-150600.3.3.1
libgit2-28 - update to 0.28.4-150200.3.9.1
rust-lsd - addressed in versions 1.0.0-3.fc38, 1.0.0-3.fc39, 1.0.0-3.fc40, 1.0.0-3.fc41
libgit2-1.1 (Ubuntu package) - update to 1.1.0+dfsg.1-4.1ubuntu0.1
libgit2 (Debian package) - addressed in versions 1.1.0+dfsg.1-4+deb11u2, 1.5.1+ds-1+deb12u1
libgit2-1_3 - update to 1.3.0-150400.3.9.1
libgit2-1_3-64bit - update to 1.3.0-150400.3.9.1
libgit2-1_3-64bit-debuginfo - update to 1.3.0-150400.3.9.1
libgit2-1_3-32bit - update to 1.3.0-150400.3.9.1
libgit2-1_3-32bit-debuginfo - update to 1.3.0-150400.3.9.1
libgit2-1_3-debuginfo - update to 1.3.0-150400.3.9.1
libgit2-1.5 (Ubuntu package) - update to 1.5.1+ds-1ubuntu1.1
libgit2 - update to 1.6.4-115
libgit2_1.6 - addressed in versions 1.6.5-1.el9, 1.6.5-1.fc39
libgit2 - addressed in versions 1.6.5-1.fc38, 1.7.2-1.fc39, 1.7.2-2.el9
libgit2-devel - update to 1.7.2-1
libgit2 - update to 1.7.2-1
libgit2-1_7 - update to 1.7.2-150600.3.3.1
libgit2-tools-debuginfo - update to 1.7.2-150600.3.3.1
libgit2-debuginfo - update to 1.7.2-150600.3.3.1
libgit2-1_7-debuginfo - update to 1.7.2-150600.3.3.1
libgit2-tools - update to 1.7.2-150600.3.3.1
python-pygit2 - update to 1.14.0-2.el9
rls - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust-debugger-common - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust-src - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust-gdb - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust-lldb - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust-debugsource - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
clippy - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust-std-static - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rustfmt - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust-analysis - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust-debuginfo - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
cargo - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust-help - addressed in versions 1.51.0-7, 1.60.0-3, 1.64.0-2, 1.64.0-3
rust-analyzer - addressed in versions 1.64.0-2, 1.64.0-3
rust - update to 1.68.2-1
rust-silver - addressed in versions 2.0.1-7.fc38, 2.0.1-7.fc39, 2.0.1-7.fc40, 2.0.1-7.fc41
git-svn - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-email - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-cvs - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-daemon - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-svn-debuginfo - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1
git-daemon-debuginfo - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-core-debuginfo - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-web - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-gui - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-core - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
gitk - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-doc - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-debugsource - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-arch - addressed in versions 2.26.2-27.75.1, 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-debuginfo - addressed in versions 2.26.2-150000.59.1, 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-credential-gnome-keyring - update to 2.35.3-150300.10.42.1
git-p4 - addressed in versions 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-credential-libsecret-debuginfo - addressed in versions 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
git-credential-gnome-keyring-debuginfo - update to 2.35.3-150300.10.42.1
git-credential-libsecret - addressed in versions 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
perl-Git - addressed in versions 2.35.3-150300.10.42.1, 2.43.0-150600.3.6.1
rust-vergen - addressed in versions 5.1.17-8.el9, 5.1.17-8.fc38, 5.1.17-8.fc39, 5.1.17-8.fc40, 5.1.17-8.fc41
rust-tokei - addressed in versions 12.1.2-8.fc38, 12.1.2-8.fc39, 12.1.2-8.fc40, 12.1.2-8.fc41

• https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8
• https://github.com/libgit2/libgit2/releases/tag/v1.6.5
• https://github.com/libgit2/libgit2/releases/tag/v1.7.2

• Multiple vulnerabilities in libgit2
• Fedora 39 update for libgit2_1.6
• Fedora 38 update for libgit2
• Fedora EPEL 9 update for libgit2, libgit2_1.6, python-pygit2
• Fedora 41 update for rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, rust-vergen
• Fedora 40 update for rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, rust-vergen
• Fedora 39 update for rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, rust-vergen
• Fedora 38 update for rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, rust-vergen
• Fedora EPEL 9 update for rust-ansitok, rust-bat, rust-cargo-c, rust-eza, rust-git-delta, rust-git2, rust-libgit2-sys, rust-pore, rust-shadow-rs, rust-strip-ansi-escapes, rust-vergen, rust-vt100, rust-vte
• Ubuntu update for libgit2
• openEuler update for libgit2
• openEuler 22.03 LTS SP1 update for rust
• openEuler 22.03 LTS SP2 update for rust
• openEuler 22.03 LTS SP3 update for rust
• openEuler 20.03 LTS SP1 update for rust
• openEuler 22.03 LTS update for rust
• openEuler 20.03 LTS SP4 update for rust
• Debian update for libgit2
• SUSE update for git
• SUSE update for libgit2
• SUSE update for libgit2
• SUSE update for git
• SUSE update for libgit2
• SUSE update for git
• SUSE update for libgit2
• SUSE update for libgit2
• SUSE update for git
• Amazon Linux AMI update for rust
• Amazon Linux AMI update for libgit2
• Anolis OS update for libgit2
• Fedora 39 update for libgit2
• Dell RecoverPoint for Virtual Machines update for third-party components