CVE-2016-2315
published 2016-04-08CVE-2016-2315: revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
17.98%
96.9th percentile
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | cgit | < git 1:2.7.0-1 (bookworm) | git 1:2.7.0-1 (bookworm) |
| debian | git | < git 1:2.7.0-1 (bookworm) | git 1:2.7.0-1 (bookworm) |
| git-scm | git | — | — |
| git | git | >= 0 < 1:2.7.0-1 | 1:2.7.0-1 |
| git | git | >= 0 < 1:2.7.0-1 | 1:2.7.0-1 |
| git | git | >= 0 < 1:2.7.0-1 | 1:2.7.0-1 |
| git | git | >= 0 < 1:2.7.0-1 | 1:2.7.0-1 |
| git | git | >= 0 < 1:1.9.1-1ubuntu0.3 | 1:1.9.1-1ubuntu0.3 |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_debuginfo | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | openstack_cloud | — | — |
| suse | suse_linux_enterprise_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability exists in the `path_name()` function in `revision.c`. Both CVE-2016-2315 and CVE-2016-2324 affect this function — monitor for exploitation attempts targeting Git push/clone operations involving large filenames or deeply nested trees. ↗
- →Attack vector is via a specially crafted packfile delivered during a Git push (attacker must authenticate to server) or Git clone (client clones from malicious repository). Detect anomalous Git clone/push operations from untrusted sources. ↗
- →Client-side attack vector: a user is tricked into cloning from a malicious Git repository. Alert on Git clone operations from unknown/untrusted remote URLs, especially those with unusually long path components or deeply nested tree structures. ↗
- →The triggering conditions are (1) a long filename or (2) many nested trees in a Git repository. Inspect incoming Git repositories/packfiles for excessively long filenames or abnormally deep directory tree nesting as a detection heuristic. ↗
- →The vulnerable code path uses `int` for length/size values (`nlen`, `len`) in `path_name()` in `revision.c`, leading to integer truncation/overflow on 64-bit systems. Flag Git versions prior to 2.4.11, 2.5.5, 2.6.6, or 2.7.4 as vulnerable in asset inventory. ↗
- ·Server-side exploitation requires the attacker to have push access (authentication) to a repository. Unauthenticated remote exploitation is only possible against Git clients performing clone operations. ↗
- ·Exploitation most likely results in a crash (denial of service), but arbitrary code execution cannot be ruled out. Detection/response should account for both outcomes. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Git vulnerabilities
vendor_ubuntu·2016-03-21·CVSS 9.8
CVE-2016-2315 [CRITICAL] Git vulnerabilities
Title: Git vulnerabilities
Summary: Git could be made to crash or run programs as your login if it received
changes from a specially crafted remote repository.
Laël Cellier discovered that Git incorrectly handled path strings in
crafted Git repositories. A remote attacker could use this issue to cause
a denial of service or possibly execute arbitrary code with the
privileges of the user invoking Git. (CVE-2016-2315, CVE-2016-2324)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
git: path_name() integer truncation and overflow leading to buffer overflow
vendor_redhat·2016-03-06·CVSS 9.8
CVE-2016-2315 [CRITICAL] CWE-131 git: path_name() integer truncation and overflow leading to buffer overflow
git: path_name() integer truncation and overflow leading to buffer overflow
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
An integer truncation flaw and an integer overflow flaw, both leading to a heap-based buffer overflow, were found in the way Git processed certain path information. A remote attacker could create a specially crafted Git repository that would cause a Git client or server to crash or, possibly, execute arbitrary code.
Statement: Red Hat Product Security has rated these issues as having Important security impact. For additional information, refer to the Red Hat Knowledgebase article: https://access.redha
Debian
CVE-2016-2315: cgit - revision.c in git before 2.7.4 uses an incorrect integer data type, which allows...
vendor_debian·2016·CVSS 9.8
CVE-2016-2315 [CRITICAL] CVE-2016-2315: cgit - revision.c in git before 2.7.4 uses an incorrect integer data type, which allows...
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-w2rr-v7j3-2w2r: revision
ghsa_unreviewed·2022-05-14
CVE-2016-2315 [CRITICAL] CWE-119 GHSA-w2rr-v7j3-2w2r: revision
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
OSV
CVE-2016-2315: revision
osv·2016-04-08·CVSS 9.8
CVE-2016-2315 [CRITICAL] CVE-2016-2315: revision
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
OSV
git vulnerabilities
osv·2016-03-21·CVSS 9.8
CVE-2016-2315 [CRITICAL] git vulnerabilities
git vulnerabilities
Laël Cellier discovered that Git incorrectly handled path strings in
crafted Git repositories. A remote attacker could use this issue to cause
a denial of service or possibly execute arbitrary code with the
privileges of the user invoking Git. (CVE-2016-2315, CVE-2016-2324)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [fedora-all]
bugzilla·2016-03-16·CVSS 9.8
CVE-2016-2315 [CRITICAL] CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [fedora-all]
CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ve
Bugzilla
CVE-2016-2315 CVE-2016-2324 git: path_name() integer truncation and overflow leading to buffer overflow
bugzilla·2016-03-15·CVSS 9.8
CVE-2016-2315 [CRITICAL] CVE-2016-2315 CVE-2016-2324 git: path_name() integer truncation and overflow leading to buffer overflow
CVE-2016-2315 CVE-2016-2324 git: path_name() integer truncation and overflow leading to buffer overflow
There is a buffer overflow vulnerability possibly leading to remote code execution in git. It can happen while pushing or cloning a repository with a large filename or a large number of nested trees.
References:
http://seclists.org/oss-sec/2016/q1/645
Parts of the original report:
http://pastebin.com/UX2P2jjg
CVE assignement notes:
http://seclists.org/oss-sec/2016/q1/653
Discussion:
Created git tracking bugs for this issue:
Affects: epel-5 [bug 1317982]
---
Isn't Fedora 23 and Fedora 22 also affected? They both have git versions below 2.7.1.
---
(In reply to Christian Stadelmann from comment #4)
> Isn't Fedora 23 and Fedora 22 also affected? They both have git versions
> belo
Bugzilla
CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [epel-5]
bugzilla·2016-03-15·CVSS 9.8
CVE-2016-2315 [CRITICAL] CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [epel-5]
CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-b
arXiv
Automated Code-centric Software Vulnerability Assessment: How Far Are We? An Empirical Study in C/C++
arxiv_fulltext·2024-08-03
Automated Code-centric Software Vulnerability Assessment: How Far Are We? An Empirical Study in C/C++
Automated Code-centric Software Vulnerability Assessment:
How Far Are We? An Empirical Study in C/C++
Anh The Nguyen
Independent Researcher Vietnam
[email protected]
Triet Huynh Minh Le
CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide
Adelaide
Australia
Cyber Security Cooperative Research Centre, Australia
[email protected]
M. Ali Babar
CREST - The Centre for Research on Engineering Software Technologies, The University of Adelaide
Adelaide
Australia
Cyber Security Cooperative Research Centre, Australia
[email protected]
## Abstract
Background:
The C/C++ languages hold significant importance in Software Engineering research because of their widespread use in practice.
Numerous studies have utilized Machin
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.htmlhttp://lists.opensuse.org/opensuse-updates/2016-04/msg00011.htmlhttp://pastebin.com/UX2P2jjghttp://rhn.redhat.com/errata/RHSA-2016-0496.htmlhttp://www.debian.org/security/2016/dsa-3521http://www.openwall.com/lists/oss-security/2016/03/15/5http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/84355http://www.securitytracker.com/id/1035290http://www.ubuntu.com/usn/USN-2938-1https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txthttps://security.gentoo.org/glsa/201605-01http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.htmlhttp://lists.opensuse.org/opensuse-updates/2016-04/msg00011.htmlhttp://pastebin.com/UX2P2jjghttp://rhn.redhat.com/errata/RHSA-2016-0496.htmlhttp://www.debian.org/security/2016/dsa-3521http://www.openwall.com/lists/oss-security/2016/03/15/5http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/84355http://www.securitytracker.com/id/1035290http://www.ubuntu.com/usn/USN-2938-1https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txthttps://security.gentoo.org/glsa/201605-01
2016-04-08
Published