Today, the Git projectreleased new versions to address a pair of security vulnerabilities, (CVE-2023-22490 andCVE-2023-23946) that affect versions 2.39.1 and older. These affect Git’s local clone optimization, as well asgit apply, respectively.

CVE-2023-22490

When cloning a repository, Git selects and uses atransport mechanism appropriate for the URL scheme of your clone. When cloning a local repository, however, Git instead uses a separatelocal clone optimization copying files directly from the source to destination.

A specially-crafted repository can trick Git into using its local clone optimization when using a non-local transport. Git will abort clones from repositories whose$GIT_DIR/objects directory contains a symbolic link. However, the top-level$GIT_DIR/objects directory may itself be a symbolic link.

These two may be combined to include arbitrary files based on known paths from a victim’s filesystem into the clone’s working copy, allowing for data exfiltration in a similar manner asCVE-2022-39253.

[source]

CVE-2023-23946

Git allows for applying arbitrary patches to your repository’s history withgit apply. In order to prevent malicious patches from creating files outside of the working copy,git apply rejects patches which attempt to write a file beyond a symbolic link.

However, this mechanism can be tricked when the malicious patch creates that symbolic link in the first place. This can be leveraged to write arbitrary files on a victim’s filesystem when applying malicious patches from untrusted sources.

[source]

Upgrade to the latest Git version

The most effective way to protect against these vulnerabilities is to upgrade to Git 2.39.2. If you can’t update immediately, reduce your risk by taking the following steps:

• Avoid runninggit clone with--recurse-submodules against untrusted repositories.
• Avoid runninggit apply /git am on input from untrusted sources.

If submodules are required by your workflow, you can clone each layer of submodules iteratively after inspecting each.gitmodules file to ensure that it does not contain suspicious module URLs.

If you are unsure about whether or not it is safe to apply a patch, you can inspect its contents withgit apply --stat. Avoid applying patches that create a symbolic link and a file beyond that link.

In order to protect users against these attacks, GitHub has taken proactive steps. Specifically, we:

• Implemented mitigation steps to prevent GitHub.com from being used as an attack vector inCVE-2023-22490 andCVE-2023-23946.
• Scheduled a GitHub Desktop release for later today, February 14, that prevents the exploitation of this vulnerability.
• Scheduled updates to GitHub Codespaces and GitHub Actions to upgrade their versions of Git.
• Scheduled updates to GitHub Enterprise Server with patched versions of Git.

Credit forCVE-2023-22490 goes to yvvdwf, and credit forCVE-2023-23946 goes to Joern Schneeweisz of GitLab. Fixes were contributed by Taylor Blau of GitHub and Patrick Steinhardt of GitLab, respectively, with additional feedback and review from members of the git-security list.

Written by

Taylor Blau

@ttaylorr

Taylor Blau is a Staff Software Engineer at GitHub where he works on Git.

• Git