CVE-2023-22743
First published: Tue Feb 14 2023(Updated: )
Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a subdirectory of a specific name living next to the Git for Windows installer, Windows can be tricked into side-loading said DLL. This potentially allows users with local write access to place malicious payloads in a location where automated upgrades might run the Git for Windows installer with elevation. Version 2.39.2 contains a patch for this issue. Some workarounds are available. Never leave untrusted files in the Downloads folder or its sub-folders before executing the Git for Windows installer, or move the installer into a different directory before executing it.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Visual Studio 2017 (includes 15.0 - 15.8) | =15.9 | |
| Microsoft Visual Studio 2019 (includes 16.0 - 16.10) | =16.11 | |
| Microsoft Visual Studio 2022 | =17.2 | |
| Microsoft Visual Studio 2022 | =17.5 | |
| Microsoft Visual Studio 2022 | =17.0 | |
| Git For Windows Project Git For Windows | <2.39.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-22743 (Advisory)
- https://attack.mitre.org/techniques/T1574/002/
- https://github.com/git-for-windows/git/releases/tag/v2.39.2.windows.1
- https://github.com/git-for-windows/git/security/advisories/GHSA-gf48-x3vr-j5c3
- https://github.com/git-for-windows/git/security/advisories/GHSA-p2x9-prp4-8gvq
- https://learn.microsoft.com/en-us/windows/win32/controls/cookbook-overview?redirectedfrom=MSDN#using-comctl32dll-version-6-in-an-application-that-uses-only-standard-extensions
- https://learn.microsoft.com/en-us/windows/win32/sbscs/about-side-by-side-assemblies-
Frequently Asked Questions
What is CVE-2023-22743?
CVE-2023-22743 is a vulnerability in Git for Windows that allows for an elevation of privilege.
How can Windows be tricked into side-loading a DLL using CVE-2023-22743?
By carefully crafting a DLL and putting it into a subdirectory with a specific name next to the Git for Windows installer, Windows can be tricked into side-loading the DLL.
What is the severity of CVE-2023-22743?
CVE-2023-22743 has a severity rating of 7.3, which is considered high.
Which versions of Git for Windows are affected by CVE-2023-22743?
Git for Windows versions prior to 2.39.2 are affected by CVE-2023-22743.
How can I fix CVE-2023-22743?
To fix CVE-2023-22743, update Git for Windows to version 2.39.2 or newer.
- collector/msrc
- collector/msrc-cve
- collector/nvd-index
- agent/author
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/remedy
- agent/type
- agent/event
- agent/software-canonical-lookup-request
- agent/references
- agent/severity
- agent/weakness
- agent/tags
- agent/description
- collector/nvd-api
- vendor/microsoft
- canonical/microsoft visual studio 2017 (includes 15.0 - 15.8)
- version/microsoft visual studio 2017 (includes 15.0 - 15.8)/15.9
- canonical/microsoft visual studio 2019 (includes 16.0 - 16.10)
- version/microsoft visual studio 2019 (includes 16.0 - 16.10)/16.11
- vendor/git for windows project
- canonical/microsoft visual studio 2022
- version/microsoft visual studio 2022/17.2
- version/microsoft visual studio 2022/17.5
- version/microsoft visual studio 2022/17.0
- version/microsoft visual studio 2022/17.4
- canonical/git for windows project git for windows