CVE-2016-2324
published 2016-04-08CVE-2016-2324: Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
18.81%
97.0th percentile
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | cgit | < git 1:2.8.0~rc3-1 (bookworm) | git 1:2.8.0~rc3-1 (bookworm) |
| debian | git | < git 1:2.8.0~rc3-1 (bookworm) | git 1:2.8.0~rc3-1 (bookworm) |
| git-scm | git | <= 2.7.3 | — |
| git | git | >= 0 < 1:2.8.0~rc3-1 | 1:2.8.0~rc3-1 |
| git | git | >= 0 < 1:2.8.0~rc3-1 | 1:2.8.0~rc3-1 |
| git | git | >= 0 < 1:2.8.0~rc3-1 | 1:2.8.0~rc3-1 |
| git | git | >= 0 < 1:2.8.0~rc3-1 | 1:2.8.0~rc3-1 |
| git | git | >= 0 < 1:1.9.1-1ubuntu0.3 | 1:1.9.1-1ubuntu0.3 |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_debuginfo | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | openstack_cloud | — | — |
| suse | suse_linux_enterprise_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability exists in the `path_name()` function in `revision.c`. Monitor for exploitation attempts targeting this function via crafted packfiles with excessively long filenames or deeply nested tree structures. ↗
- →CVE-2016-2324 is triggered by an integer overflow in the loop that accumulates path element lengths into `len`. Detect by monitoring Git operations (clone/push/fetch) involving repositories with a very large number of nested trees or extremely long filenames that could overflow a signed `int`. ↗
- →Attack vector is a specially crafted packfile delivered via push (attacker needs push access) or clone (user tricked into cloning malicious repo). Alert on unexpected Git process crashes (heap corruption) during clone/fetch/push operations as a potential exploitation indicator. ↗
- →For server-side exposure, the attacker must be authenticated and able to push to a repository. Audit push access controls and monitor server-side Git crashes during pack reception on versions prior to 2.4.11, 2.5.5, 2.6.6, or 2.7.4. ↗
- →For client-side exposure, monitor for users cloning from untrusted or unknown Git repositories. A crash of the git process during clone is a strong indicator of exploitation attempt. ↗
- ·The vulnerability affects Git versions before 2.7.4 (also fixed in backport releases 2.4.11, 2.5.5, and 2.6.6). Ensure all Git installations are at or above these versions. ↗
- ·Exploitation results in heap corruption that most likely crashes Git, but arbitrary code execution cannot be ruled out. Treat any unexplained Git crash during pack processing as a potential security event. ↗
- ·The original vulnerability report and PoC details are referenced at http://pastebin.com/UX2P2jjg and http://seclists.org/oss-sec/2016/q1/645 — review these for additional technical context on crafted repository structure. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p4rj-f9j6-8r9q: Integer overflow in Git before 2
ghsa_unreviewed·2022-05-13
CVE-2016-2324 [CRITICAL] CWE-119 GHSA-p4rj-f9j6-8r9q: Integer overflow in Git before 2
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.
OSV
CVE-2016-2324: Integer overflow in Git before 2
osv·2016-04-08·CVSS 9.8
CVE-2016-2324 [CRITICAL] CVE-2016-2324: Integer overflow in Git before 2
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.
OSV
git vulnerabilities
osv·2016-03-21·CVSS 9.8
CVE-2016-2315 [CRITICAL] git vulnerabilities
git vulnerabilities
Laël Cellier discovered that Git incorrectly handled path strings in
crafted Git repositories. A remote attacker could use this issue to cause
a denial of service or possibly execute arbitrary code with the
privileges of the user invoking Git. (CVE-2016-2315, CVE-2016-2324)
Ubuntu
Git vulnerabilities
vendor_ubuntu·2016-03-21·CVSS 9.8
CVE-2016-2315 [CRITICAL] Git vulnerabilities
Title: Git vulnerabilities
Summary: Git could be made to crash or run programs as your login if it received
changes from a specially crafted remote repository.
Laël Cellier discovered that Git incorrectly handled path strings in
crafted Git repositories. A remote attacker could use this issue to cause
a denial of service or possibly execute arbitrary code with the
privileges of the user invoking Git. (CVE-2016-2315, CVE-2016-2324)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
git: path_name() integer truncation and overflow leading to buffer overflow
vendor_redhat·2016-03-06·CVSS 9.8
CVE-2016-2324 [CRITICAL] CWE-131 git: path_name() integer truncation and overflow leading to buffer overflow
git: path_name() integer truncation and overflow leading to buffer overflow
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.
An integer truncation flaw and an integer overflow flaw, both leading to a heap-based buffer overflow, were found in the way Git processed certain path information. A remote attacker could create a specially crafted Git repository that would cause a Git client or server to crash or, possibly, execute arbitrary code.
Statement: Red Hat Product Security has rated these issues as having Important security impact. For additional information, refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/2201201
Debian
CVE-2016-2324: cgit - Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrar...
vendor_debian·2016·CVSS 9.8
CVE-2016-2324 [CRITICAL] CVE-2016-2324: cgit - Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrar...
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [fedora-all]
bugzilla·2016-03-16·CVSS 9.8
CVE-2016-2315 [CRITICAL] CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [fedora-all]
CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ve
Bugzilla
CVE-2016-2315 CVE-2016-2324 git: path_name() integer truncation and overflow leading to buffer overflow
bugzilla·2016-03-15·CVSS 9.8
CVE-2016-2315 [CRITICAL] CVE-2016-2315 CVE-2016-2324 git: path_name() integer truncation and overflow leading to buffer overflow
CVE-2016-2315 CVE-2016-2324 git: path_name() integer truncation and overflow leading to buffer overflow
There is a buffer overflow vulnerability possibly leading to remote code execution in git. It can happen while pushing or cloning a repository with a large filename or a large number of nested trees.
References:
http://seclists.org/oss-sec/2016/q1/645
Parts of the original report:
http://pastebin.com/UX2P2jjg
CVE assignement notes:
http://seclists.org/oss-sec/2016/q1/653
Discussion:
Created git tracking bugs for this issue:
Affects: epel-5 [bug 1317982]
---
Isn't Fedora 23 and Fedora 22 also affected? They both have git versions below 2.7.1.
---
(In reply to Christian Stadelmann from comment #4)
> Isn't Fedora 23 and Fedora 22 also affected? They both have git versions
> belo
Bugzilla
CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [epel-5]
bugzilla·2016-03-15·CVSS 9.8
CVE-2016-2315 [CRITICAL] CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [epel-5]
CVE-2016-2315 CVE-2016-2324 git: remote code execution via buffer overflow [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-b
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.htmlhttp://lists.opensuse.org/opensuse-updates/2016-04/msg00011.htmlhttp://pastebin.com/UX2P2jjghttp://rhn.redhat.com/errata/RHSA-2016-0496.htmlhttp://www.debian.org/security/2016/dsa-3521http://www.openwall.com/lists/oss-security/2016/03/15/5http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/84355http://www.securitytracker.com/id/1035290http://www.ubuntu.com/usn/USN-2938-1https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txthttps://security.gentoo.org/glsa/201605-01http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.htmlhttp://lists.opensuse.org/opensuse-updates/2016-04/msg00011.htmlhttp://pastebin.com/UX2P2jjghttp://rhn.redhat.com/errata/RHSA-2016-0496.htmlhttp://www.debian.org/security/2016/dsa-3521http://www.openwall.com/lists/oss-security/2016/03/15/5http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/84355http://www.securitytracker.com/id/1035290http://www.ubuntu.com/usn/USN-2938-1https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txthttps://security.gentoo.org/glsa/201605-01
2016-04-08
Published