CVE-2022-24765: Uncontrolled search for the Git directory in Git for Windows
A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.
Other sources
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder C:\.git, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set GITPS1SHOWDIRTYSTATE are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in C:\.git\config. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder .git on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend GITCEILINGDIRECTORIES to cover the parent directory of the user profile, e.g. C:\Users if the user profile is located in C:\Users\my-user-name.
Git. A logic issue was addressed with improved state management.
On multi-user machines, Git users might find themselves unexpectedly in a Git worktree, e.g. when there is a scratch space (/scratch/) intended for all users and another user created a repository in /scratch/.git. Merely having a Git-aware prompt that runs git status (or git diff) and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user via /scratch/.git/config.
— Red Hat
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/gitto a version that resolves this vulnerability.Fixed in 0:2.39.1-1.el8 - Upgrade
Upgrade
redhat/gitto a version that resolves this vulnerability.Fixed in 0:2.39.1-1.el9 - Upgrade
Upgrade
redhat/gitto a version that resolves this vulnerability.Fixed in 2.30.3 - Upgrade
Upgrade
redhat/gitto a version that resolves this vulnerability.Fixed in 2.31.2 - Upgrade
Upgrade
redhat/gitto a version that resolves this vulnerability.Fixed in 2.32.1 - Upgrade
Upgrade
redhat/gitto a version that resolves this vulnerability.Fixed in 2.33.2 - Upgrade
Upgrade
redhat/gitto a version that resolves this vulnerability.Fixed in 2.34.2 - Upgrade
Upgrade
redhat/gitto a version that resolves this vulnerability.Fixed in 2.35.2 - Upgrade
Upgrade
redhat/and gitto a version that resolves this vulnerability.Fixed in 2.36.0 - Upgrade
Upgrade
Apple Xcodeto a version that resolves this vulnerability.Fixed in 13.4 - Upgrade
Upgrade
debian/gitto a version that resolves this vulnerability.Fixed in 1:2.39.5-0+deb12u3Fixed in 1:2.39.5-0+deb12u2Fixed in 1:2.47.3-0+deb13u1Fixed in 1:2.53.0-1Fixed in 1:2.55.0-1 - Upgrade
Upgrade
alpine/gitto a version that resolves this vulnerability.Fixed in 2.30.3-r0 - Upgrade
Upgrade
alpine/gitto a version that resolves this vulnerability.Fixed in 2.32.1-r0 - Upgrade
Upgrade
alpine/gitto a version that resolves this vulnerability.Fixed in 2.34.2-r0 - Upgrade
Upgrade
alpine/gitto a version that resolves this vulnerability.Fixed in 2.35.2-r0 - Upgrade
Upgrade
alpine/libgit2to a version that resolves this vulnerability.Fixed in 1.4.4-r0 - Upgrade
Upgrade
debian/gitto a version that resolves this vulnerability.Fixed in 1:2.35.2-1 - Upgrade
Upgrade
Git for Windowsto a version that resolves this vulnerability.Fixed in 2.35.2 - Configuration
Define or extend GIT_CEILING_DIRECTORIES to cover the parent directory of the user profile, such as C:\Users when the profile is located in C:\Users\my-user-name.
Git GIT_CEILING_DIRECTORIES = the parent directory of the user profile - Compensating control
If unable to upgrade, create the folder .git on all drives where Git commands are run and remove read/write access from those folders.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-24765?
CVE-2022-24765 is a logic issue in Git that has been addressed with improved state management.
Who does the vulnerability CVE-2022-24765 affect?
The vulnerability affects users working on multi-user machines where untrusted parties have write access to the same hard disk.
How can the vulnerability CVE-2022-24765 be exploited?
Untrusted parties could create the folder `C:\.git` on the affected machine, which would be picked up by Git operations.
What is the severity of CVE-2022-24765?
CVE-2022-24765 has a severity rating of 7.8 (High).
How can I fix the vulnerability CVE-2022-24765?
The vulnerability can be fixed by updating Git to version 2.30.3 or above.