Infinite loop in libgit2 - CVE-2024-24575

Vulnerability identifier: #VU86202

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-24575

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in git_revparse_single within the revparse() function in src/libgit2/revparse.c. A remote attacker can consume all available system resources and cause denial of service conditions.

libgit2
Amazon Linux AMI
Debian Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
Fedora
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
libgit2-26 (Ubuntu package)
libgit2-24 (Ubuntu package)
rust-pore
rust-strip-ansi-escapes
rust-ansitok
rust-pretty-git-prompt
rust-git-absorb
rust-shadow-rs
rust-cargo-c
rust-vte
rust-vt100
rust-libgit2-sys
rust-git-delta
rust-eza
rust-git2
rust-bat
rust-asyncgit
rust-gitui
libgit2-28 (Ubuntu package)
rust-lsd
libgit2-1.1 (Ubuntu package)
libgit2 (Debian package)
libgit2-1.5 (Ubuntu package)
libgit2
libgit2_1.6
libgit2-devel
libgit2-tools
libgit2-1_7-debuginfo
libgit2-debuginfo
libgit2-debugsource
libgit2-tools-debuginfo
libgit2-1_7
python-pygit2
rust-help
rust-src
rust-lldb
rust-debugger-common
rust-gdb
rust-debugsource
rust-debuginfo
clippy
rls
rust-analyzer
cargo
rustfmt
rust-std-static
rust-analysis
rust
rust-silver
rust-vergen
rust-tokei

Install updates from vendor's website.

libgit2 - addressed in versions 1.6.5, 1.7.2
libgit2-26 (Ubuntu package) - update to Ubuntu Pro
libgit2-24 (Ubuntu package) - update to Ubuntu Pro
rust-pore - addressed in versions 0.1.10-3.el9, 0.1.10-3.fc38, 0.1.10-3.fc39, 0.1.10-3.fc40, 0.1.10-3.fc41
rust-strip-ansi-escapes - update to 0.2.0-2.el9
rust-ansitok - update to 0.2.0-4.el9
rust-pretty-git-prompt - addressed in versions 0.2.1-20.fc38, 0.2.1-20.fc39, 0.2.1-20.fc40, 0.2.1-20.fc41
rust-git-absorb - addressed in versions 0.6.11-3.fc38, 0.6.11-3.fc39, 0.6.11-3.fc40, 0.6.11-3.fc41
rust-shadow-rs - addressed in versions 0.8.1-8.el9, 0.8.1-8.fc38, 0.8.1-8.fc39, 0.8.1-8.fc40, 0.8.1-8.fc41
rust-cargo-c - addressed in versions 0.9.27-4.el9, 0.9.28-4.fc38, 0.9.28-4.fc39, 0.9.28-4.fc40, 0.9.28-4.fc41
rust-vte - update to 0.13.0-1.el9
rust-vt100 - update to 0.15.2-2.el9
rust-libgit2-sys - addressed in versions 0.16.2-1.el9, 0.16.2-1.fc38, 0.16.2-1.fc39, 0.16.2-1.fc40, 0.16.2-1.fc41
rust-git-delta - addressed in versions 0.16.5-9.el9, 0.16.5-9.fc38, 0.16.5-9.fc39, 0.16.5-9.fc40, 0.16.5-9.fc41
rust-eza - addressed in versions 0.17.3-2.el9, 0.17.3-2.fc38, 0.17.3-2.fc39, 0.17.3-2.fc40, 0.17.3-2.fc41
rust-git2 - addressed in versions 0.18.2-1.el9, 0.18.2-1.fc38, 0.18.2-1.fc39, 0.18.2-1.fc40, 0.18.2-1.fc41
rust-bat - addressed in versions 0.24.0-2.el9, 0.24.0-3.fc38, 0.24.0-3.fc39, 0.24.0-3.fc40, 0.24.0-3.fc41
rust-asyncgit - addressed in versions 0.24.3-3.fc38, 0.24.3-3.fc39, 0.24.3-3.fc40, 0.24.3-3.fc41
rust-gitui - addressed in versions 0.24.3-4.fc38, 0.24.3-4.fc39, 0.24.3-4.fc40, 0.24.3-4.fc41
libgit2-28 (Ubuntu package) - update to 0.28.4+dfsg.1-2ubuntu0.1
rust-lsd - addressed in versions 1.0.0-3.fc38, 1.0.0-3.fc39, 1.0.0-3.fc40, 1.0.0-3.fc41
libgit2-1.1 (Ubuntu package) - update to 1.1.0+dfsg.1-4.1ubuntu0.1
libgit2 (Debian package) - addressed in versions 1.1.0+dfsg.1-4+deb11u2, 1.5.1+ds-1+deb12u1
libgit2-1.5 (Ubuntu package) - update to 1.5.1+ds-1ubuntu1.1
libgit2 - update to 1.6.4-115
libgit2_1.6 - addressed in versions 1.6.5-1.el9, 1.6.5-1.fc39
libgit2 - addressed in versions 1.6.5-1.fc38, 1.7.2-1.fc39, 1.7.2-2.el9
libgit2-devel - update to 1.7.2-1
libgit2 - update to 1.7.2-1
libgit2-devel - update to 1.7.2-150600.3.3.1
libgit2-tools - update to 1.7.2-150600.3.3.1
libgit2-1_7-debuginfo - update to 1.7.2-150600.3.3.1
libgit2-debuginfo - update to 1.7.2-150600.3.3.1
libgit2-debugsource - update to 1.7.2-150600.3.3.1
libgit2-tools-debuginfo - update to 1.7.2-150600.3.3.1
libgit2-1_7 - update to 1.7.2-150600.3.3.1
python-pygit2 - update to 1.14.0-2.el9
rust-help - addressed in versions 1.64.0-2, 1.64.0-3
rust-src - addressed in versions 1.64.0-2, 1.64.0-3
rust-lldb - addressed in versions 1.64.0-2, 1.64.0-3
rust-debugger-common - addressed in versions 1.64.0-2, 1.64.0-3
rust-gdb - addressed in versions 1.64.0-2, 1.64.0-3
rust-debugsource - addressed in versions 1.64.0-2, 1.64.0-3
rust-debuginfo - addressed in versions 1.64.0-2, 1.64.0-3
clippy - addressed in versions 1.64.0-2, 1.64.0-3
rls - addressed in versions 1.64.0-2, 1.64.0-3
rust-analyzer - addressed in versions 1.64.0-2, 1.64.0-3
cargo - addressed in versions 1.64.0-2, 1.64.0-3
rustfmt - addressed in versions 1.64.0-2, 1.64.0-3
rust-std-static - addressed in versions 1.64.0-2, 1.64.0-3
rust-analysis - addressed in versions 1.64.0-2, 1.64.0-3
rust - addressed in versions 1.64.0-2, 1.64.0-3
rust - update to 1.68.2-1
rust-silver - addressed in versions 2.0.1-7.fc38, 2.0.1-7.fc39, 2.0.1-7.fc40, 2.0.1-7.fc41
rust-vergen - addressed in versions 5.1.17-8.el9, 5.1.17-8.fc38, 5.1.17-8.fc39, 5.1.17-8.fc40, 5.1.17-8.fc41
rust-tokei - addressed in versions 12.1.2-8.fc38, 12.1.2-8.fc39, 12.1.2-8.fc40, 12.1.2-8.fc41

• https://github.com/libgit2/libgit2/security/advisories/GHSA-54mf-x2rh-hq9v
• https://github.com/libgit2/libgit2/commit/add2dabb3c16aa49b33904dcdc07cd915efc12fa
• https://github.com/libgit2/libgit2/releases/tag/v1.6.5
• https://github.com/libgit2/libgit2/releases/tag/v1.7.2

• Multiple vulnerabilities in libgit2
• Fedora 39 update for libgit2_1.6
• Fedora 38 update for libgit2
• Fedora EPEL 9 update for libgit2, libgit2_1.6, python-pygit2
• Fedora 41 update for rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, rust-vergen
• Fedora 40 update for rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, rust-vergen
• Fedora 39 update for rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, rust-vergen
• Fedora 38 update for rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, rust-vergen
• Fedora EPEL 9 update for rust-ansitok, rust-bat, rust-cargo-c, rust-eza, rust-git-delta, rust-git2, rust-libgit2-sys, rust-pore, rust-shadow-rs, rust-strip-ansi-escapes, rust-vergen, rust-vt100, rust-vte
• Ubuntu update for libgit2
• openEuler 22.03 LTS SP2 update for rust
• openEuler 22.03 LTS SP3 update for rust
• Debian update for libgit2
• SUSE update for libgit2
• Amazon Linux AMI update for rust
• Amazon Linux AMI update for libgit2
• Anolis OS update for libgit2
• Fedora 39 update for libgit2