CVE-2022-39260
Git vulnerable to Remote Code Execution via Heap overflow in `git shell`
Published Oct 19, 2022
CVSS 3.1 · 8.5 High
EPSS 4.0%
KEV · Not listed
Description
Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| git | git | affected |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
Configuration 3 [-]
|
Configuration 4 [-]
|
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | |||
| git-0:2.39.1-1.el8 | cpe:/a:redhat:enterprise_linux:8 | RHSA-2023:2859 | 2023-05-16T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Extended Update Support | |||
| git-0:2.31.8-1.el8_6 | cpe:/a:redhat:rhel_eus:8.6 | RHSA-2024:0407 | 2024-01-25T00:00:00Z |
| Red Hat Enterprise Linux 9 | |||
| git-0:2.39.1-1.el9 | cpe:/a:redhat:enterprise_linux:9 | RHSA-2023:2319 | 2023-05-09T00:00:00Z |
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-3239-1 | git security update |
| Debian DLA |
DLA-3239-2 | git regression update |
 Debian DSA |
DSA-5332-1 | git security update |
 EUVD |
EUVD-2022-41771 | Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround. |
 Ubuntu USN |
USN-5686-1 | Git vulnerabilities |
| Ubuntu USN |
USN-5686-2 | Git vulnerability |
| Ubuntu USN |
USN-5686-3 | Git vulnerabilities |
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity High
Privileges Required Low
Scope Changed
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: 4.0% (3.987% probability within 30 days)
Key SSVC decision points have not yet been added.
References
History
No history.
