Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/git/git: CVE-2024-32021 #2840

Closed
GoVulnBot opened this issue May 14, 2024 · 1 comment
Closed

x/vulndb: potential Go vuln in github.com/git/git: CVE-2024-32021 #2840

GoVulnBot opened this issue May 14, 2024 · 1 comment
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module.

Comments

@GoVulnBot
Copy link

CVE-2024-32021 references github.com/git/git, which may be a Go module.

Description:
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the objects/ directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's objects/ directory. When cloning a repository over the filesystem (without explicitly specifying the file:// protocol or --no-local), the optimizations for local cloning
will be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/git/git
      vulnerable_at: 2.45.1+incompatible
      packages:
        - package: git
summary: CVE-2024-32021 in github.com/git/git
cves:
    - CVE-2024-32021
references:
    - advisory: https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7
source:
    id: CVE-2024-32021
@tatianab tatianab added excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. possibly not Go triaged and removed possibly not Go excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. triaged labels Jun 5, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/590855 mentions this issue: data/excluded: add 20 excluded reports

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@tatianab @gopherbot @GoVulnBot