PT-2024-1690 · Libgit2+4 · Libgit2+4
Ethomson
·
Published
2024-02-06
·
Updated
2025-01-28
·
CVE-2024-24575
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libgit2 versions prior to 1.7.2
Description
The issue is related to the
git revparse single function, which can enter an infinite loop when provided with well-crafted inputs, potentially causing a Denial of Service attack. The revparse function in src/libgit2/revparse.c uses a loop to parse the user-provided spec string, and there is an edge-case that allows a bad actor to force the loop conditions to access arbitrary memory, potentially leading to memory leaks.Recommendations
For libgit2 versions prior to 1.7.2, upgrade to version 1.7.2 to resolve the issue. As a temporary workaround, consider restricting the use of the
git revparse single function to minimize the risk of exploitation. Avoid using the git revparse single function with untrusted input until the issue is resolved.Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Red Os
Suse
Ubuntu
Libgit2