Bug 931941 (CVE-2024-32002, CVE-2024-32004, CVE-2024-32020, CVE-2024-32021, CVE-2024-32465) – <dev-vcs/git-{2.39.4, 2.41.1, 2.43.4, 2.44.1, 2.45.1}: Multiple vulnerabilities

• Product: Gentoo Security
• Status: IN_PROGRESS ---

[Description Sam James 2024-05-15 09:21:58 UTC]

"""

Team,

The Git project released new security bug-fix versions today, May 14th,
2024: v2.45.1, v2.44.1, v2.43.4, v2.42.2, v2.41.1, v2.40.2, and v2.39.4.

The addressed issues are:

 * CVE-2024-32002
 * (https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv):

   Recursive clones on case-insensitive filesystems that support symbolic
   links are susceptible to case confusion that can be exploited to
   execute just-cloned code during the clone operation.

   This allows the attack where a recursive clone would first initialize a
   submodule, then replace its parent directory with a symbolic link into
   the `.git/` directory where the second stage of the recursive clone
   would then write e.g. hooks that would be immediately executed before
   the user has had a chance to inspect what is getting executed.

   Credit for finding the vulnerability goes to Filip Hejsek, credit for
   fixing it goes to Johannes Schindelin.

 * CVE-2024-32004
 * (https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389):

   Repositories can be configured to execute arbitrary code during local
   clones. To address this, the ownership checks introduced in v2.30.3
   are now extended to cover cloning local repositories.

   The most obvious attack vector is to prepare a local partial clone that
   is intentionally missing objects, override in its config what
   `upload-pack` executable use, and then talk another user on the same
   machine to clone that. This will run that configured `upload-pack`
   executable under using person's permissions.

   Credit for finding the vulnerability goes to Filip Hejsek, credit for
   fixing it goes to Johannes Schindelin.

 * CVE-2024-32020
 * (https://github.com/git/git/security/advisories/GHSA-5rfh-556j-fhgj):

   Local clones may end up hardlinking files into the target repository's
   object database when source and target repository reside on the same
   disk. If the source repository is owned by a different user, then
   those hardlinked files may be rewritten at any point in time by the
   untrusted user.

   This vulnerability allows a bait-and-switch attack where individual
   objects are replaced in already-indexed pack file; Git will not verify
   that the object's contents match its recorded object ID in that case.

   Credit for finding and for fixing the vulnerability goes to Patrick
   Steinhardt.

 * CVE-2024-32021
 * (https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7):

   When cloning a local source repository that contains symlinks via the
   filesystem, Git may create hardlinks to arbitrary user-readable files
   on the same filesystem as the target repository in the objects/
   directory.

   This allows the same attack vector that CVE-2022-39253 tried to
   prevent, by exploiting a time-of-check-time-of-use race.

   Credit for finding and for fixing the vulnerability goes to Patrick
   Steinhardt.

 * CVE-2024-32465
 * (https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4):

   It is supposed to be safe to clone untrusted repositories, even those
   unpacked from zip archives or tarballs originating from untrusted
   sources, but Git can be tricked to run arbitrary code as part of the
   clone.

   The attack vectors are the same as for the CVEs mentioned above that
   involve local clones, but social-engineering is required to manipulate
   a user into unpacking a `.zip` file and running Git commands on the
   unpacked files.

   Credit for finding and for fixing the vulnerability goes to Jeff King.
"""

[Comment 1 Larry the Git Cow 2024-05-15 12:06:34 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a7b443b0c2cffccfd5d8fef26d2e666192944525

commit a7b443b0c2cffccfd5d8fef26d2e666192944525
Author:     Sam James <[e-mail]>
AuthorDate: 2024-05-15 12:04:21 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-05-15 12:05:08 +0000

    dev-vcs/git: add 2.45.1
    
    Bug: https://bugs.gentoo.org/931941
    Signed-off-by: Sam James <[e-mail]>

 dev-vcs/git/Manifest          |   3 +
 dev-vcs/git/git-2.45.1.ebuild | 646 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 649 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6ce8e7c222121abec49371ca80f7dc86eccf5e9f

commit 6ce8e7c222121abec49371ca80f7dc86eccf5e9f
Author:     Sam James <[e-mail]>
AuthorDate: 2024-05-15 11:53:55 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-05-15 12:05:07 +0000

    dev-vcs/git: add 2.44.1
    
    Bug: https://bugs.gentoo.org/931941
    Signed-off-by: Sam James <[e-mail]>

 dev-vcs/git/Manifest          |   3 +
 dev-vcs/git/git-2.44.1.ebuild | 647 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 650 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6c33ce83db9529c38bdaa2db0d552893a2ab235b

commit 6c33ce83db9529c38bdaa2db0d552893a2ab235b
Author:     Sam James <[e-mail]>
AuthorDate: 2024-05-15 11:43:07 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-05-15 12:05:06 +0000

    dev-vcs/git: add 2.43.4
    
    Bug: https://bugs.gentoo.org/931941
    Signed-off-by: Sam James <[e-mail]>

 dev-vcs/git/Manifest          |   3 +
 dev-vcs/git/git-2.43.4.ebuild | 644 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 647 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f9a42a726076be2900b5c6718e854a95d17318b1

commit f9a42a726076be2900b5c6718e854a95d17318b1
Author:     Sam James <[e-mail]>
AuthorDate: 2024-05-15 11:35:28 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-05-15 12:05:05 +0000

    dev-vcs/git: add 2.41.1
    
    Bug: https://bugs.gentoo.org/931941
    Signed-off-by: Sam James <[e-mail]>

 dev-vcs/git/Manifest          |   3 +
 dev-vcs/git/git-2.41.1.ebuild | 644 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 647 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7fb5aefa50c69372e653f9890d9fcfccc8ea5b0a

commit 7fb5aefa50c69372e653f9890d9fcfccc8ea5b0a
Author:     Sam James <[e-mail]>
AuthorDate: 2024-05-15 11:29:25 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-05-15 12:05:05 +0000

    dev-vcs/git: add 2.39.4
    
    Bug: https://bugs.gentoo.org/931941
    Signed-off-by: Sam James <[e-mail]>

 dev-vcs/git/Manifest          |   3 +
 dev-vcs/git/git-2.39.4.ebuild | 644 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 647 insertions(+)

[Comment 2 Sam James 2024-06-01 00:51:44 UTC]

I've cranked the stablereqs to handle bug 932091.