CVE-2024-32002

Published May 14, 2024

Last updated a year ago

Git

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-32002 is a vulnerability that affects Git, a widely used revision control system. It exists in versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. The vulnerability involves how Git handles submodules, which can be exploited to write files into the `.git/` directory instead of the intended submodule's worktree. This flaw allows an attacker to craft repositories that, when cloned, can execute a malicious hook during the cloning operation. This occurs because the attacker can write a hook script into the `.git/` directory that will run while the clone operation is still in progress, preventing the user from inspecting the code being executed.

Description: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.
Source: security-advisories@github.com
NVD status: Modified
Products: git

Risk scores

CVSS 3.1

Type: Primary
Base score: 9
Impact score: 6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-22
nvd@nist.gov: CWE-59

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 10

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:git:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "67C50136-86FF-4BCF-B21F-5F09947CF6AC",
            "versionEndExcluding": "2.39.4",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "28F0EBE5-AAB1-4BC8-B3CA-5F0B3D71642B",
            "versionEndExcluding": "2.40.2",
            "versionStartIncluding": "2.40.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "790B191F-6DD7-4F0A-96BD-BAD5CF3F2081",
            "versionEndExcluding": "2.42.2",
            "versionStartIncluding": "2.42.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git:git:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "14C6890A-11D9-46CD-AF1D-85FAF61A0AA8",
            "versionEndExcluding": "2.43.4",
            "versionStartIncluding": "2.43.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git:git:2.41.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "09120A06-22E2-45A6-93B3-913DB7F52788",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git:git:2.44.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "A641AB1F-0712-43F6-B7D6-E19D1D88D3C3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:git:git:2.45.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "1E742D5F-55D2-47D7-A3CC-C359A4555E7E",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.