GHSA-v48j-4xgg-4844: Arbitrary configuration injection via `git submodule deinit`

Q: What does an attacker need to do to trigger the issue?

The attacker needs to provide a repository containing a specially crafted .gitmodules file with submodule URLs longer than 1024 characters. Exploitation occurs when a user runs git submodule deinit and Git removes the configuration section for the affected submodule.

Q: When can configuration injection become code execution?

Injected configuration can lead to remote code execution if it sets options that specify executables to run, such as core.pager, core.editor, or core.sshCommand. The injected values are written into the user's $GIT_DIR/config.

Q: Which Git releases contain the fix?

The fix is available in Git 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1.

Q: What can be done before updating Git?

Do not run git submodule deinit on untrusted repositories. Before running it, inspect the submodule sections in $GIT_DIR/config.

Published Apr 25, 2023

Updated

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted .gitmodules file with submodule URLs that are longer than 1024 characters can used to exploit a bug in config.c::gitconfigcopyorrenamesectioninfile(). This bug can be used to inject arbitrary configuration into a user's $GITDIR/config when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as core.pager, core.editor, core.sshCommand, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running git submodule deinit on untrusted repositories or without prior inspection of any submodule sections in $GITDIR/config.

Affected Software

1 affected component

Git Git<2.30.9, <2.31.8, <2.32.7, <2.33.8, <2.34.8, <2.35.8, <2.36.6, <2.37.7, <2.38.5, <2.39.3, <2.40.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.30.9
Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.31.8
Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.32.7
Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.33.8
Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.34.8
Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.35.8
Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.36.6
Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.37.7
Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.38.5
Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.39.3
Upgrade
Upgrade Git to a version that resolves this vulnerability.
Fixed in 2.40.1
Compensating control
Avoid running git submodule deinit on untrusted repositories or without prior inspection of submodule sections in $GIT_DIR/config.

Event History

Apr 25, 2023

CVE Published

via OSV·08:09 PM

Data Sourced

via OSV·08:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to do to trigger the issue?

The attacker needs to provide a repository containing a specially crafted .gitmodules file with submodule URLs longer than 1024 characters. Exploitation occurs when a user runs git submodule deinit and Git removes the configuration section for the affected submodule.

When can configuration injection become code execution?

Injected configuration can lead to remote code execution if it sets options that specify executables to run, such as core.pager, core.editor, or core.sshCommand. The injected values are written into the user's $GIT_DIR/config.

Which Git releases contain the fix?

The fix is available in Git 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1.

What can be done before updating Git?

Do not run git submodule deinit on untrusted repositories. Before running it, inspect the submodule sections in $GIT_DIR/config.

GHSA-v48j-4xgg-4844: Arbitrary configuration injection via `git submodule deinit`

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to do to trigger the issue?

When can configuration injection become code execution?

Which Git releases contain the fix?

What can be done before updating Git?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to do to trigger the issue?

When can configuration injection become code execution?

Which Git releases contain the fix?

What can be done before updating Git?