PT-2024-1689 · Libgit2+6 · Libgit2+6

Ethomson

·

Published

2024-02-06

·

Updated

2025-09-22

·

CVE-2024-24577

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions libgit2 versions prior to 1.6.5 libgit2 versions prior to 1.7.2
Description The issue is related to a heap corruption vulnerability in the has dir name function in src/libgit2/index.c, which can be exploited for arbitrary code execution. This can occur when using well-crafted inputs to git index add, allowing a remote attacker to potentially execute arbitrary code. The vulnerability is due to the freeing of an entry that should not be freed, which is later used and overwritten with potentially bad actor-controlled data, leading to controlled heap corruption.
Recommendations For versions prior to 1.6.5, update to version 1.6.5 or later. For versions prior to 1.7.2, update to version 1.7.2 or later. As a temporary workaround, consider restricting the use of the git index add function until a patch is available. Avoid using the has dir name function in src/libgit2/index.c until the issue is resolved.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

Related Identifiers

ALT-PU-2024-7165
AZL-34274
BDU:2024-01377
CVE-2024-24577
DLA-3742-1
DSA-5619-1
GHSA-J2V7-4F6V-GPG8
MGASA-2024-0059
OESA-2024-1188
OESA-2024-1201
OESA-2024-1202
OESA-2024-1203
OESA-2024-1204
OESA-2024-1205
OESA-2024-1206
OPENSUSE-SU-2024:13661-1
OPENSUSE-SU-2024:14212-1
OPENSUSE-SU-2024_2584-1
OPENSUSE-SU-2024_2619-1
ROSA-SA-2025-2656
RUSTSEC-2024-0013
SUSE-SU-2024:2579-1
SUSE-SU-2024:2583-1
SUSE-SU-2024:2584-1
SUSE-SU-2024:2592-1
SUSE-SU-2024:2598-1
SUSE-SU-2024:2599-1
SUSE-SU-2024:2610-1
SUSE-SU-2024:2619-1
SUSE-SU-2024:2656-1
SUSE-SU-2024_2579-1
SUSE-SU-2024_2583-1
SUSE-SU-2024_2592-1
SUSE-SU-2024_2598-1
SUSE-SU-2024_2599-1
SUSE-SU-2024_2610-1
SUSE-SU-2024_2619-1
SUSE-SU-2024_2656-1
SUSE-SU-2025:20721-1
USN-6678-1

Affected Products

Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Libgit2