Today, the Git project released new versions to address a pair of security vulnerabilities, CVE-2023-25652 and CVE-2023-29007, that affect versions 2.40.0 and older.
Git was also patched to address additional, Windows-specific vulnerabilities: CVE-2023-25815, CVE-2023-29011, and CVE-2023-29012. The Git for Windows project released new versions including the fixes for all five of these vulnerabilities.
To protect against CVE-2023-25652 and CVE-2023-2907, users are encouraged to upgrade immediately. The former may be used to perform controlled content writes at arbitrary paths with
git apply --reject. The latter may be used to inject arbitrary configuration settings, which may in turn be used to achieve arbitrary code execution.
The Windows-specific issues affect users on multi-user machines, users working in Git CMD, and users leveraging the SOCKS5 proxy
connect.exe that is included in the Git for Windows distribution. Users fitting any of these descriptions are also encouraged to upgrade immediately.
When applying patches with
git apply, Git rejects inputs that attempt to write a file beyond a symbolic link. In Git 2.39.1, this mechanism was updated to reject patches which themselves created symbolic links and attempted to write beyond them.
However, this fix was incomplete: when using
git apply --reject to write out rejected hunks from the patch as
*.rej files, specially crafted malicious patches can perform controlled content writes at arbitrary locations.
Git’s implementation used to rename or delete sections of a configuration file contained a logic error that resulted in improperly treating configuration values longer than a fixed length as containing new sections.
This can result in arbitrary configuration injection into a user’s
$GIT_DIR/config when attempting to rename or remove a malicious configuration section. This may be used to achieve arbitrary code execution, via configuration values that specify executables, such as
core.sshCommand, and so on.
This vulnerability may be exploited by using overly-long submodule URLs, which are stored in a user’s
$GIT_DIR/config upon initialization. Those URLs may be misinterpreted as containing new configuration material when removing those sections, for example, with
git submodule deinit.
A recent change in one of the packages shipped with Git for Windows caused the
gettext() function to use the hard-coded path
C:\mingw64\share\locale when looking for localization messages instead of respecting the runtime prefix.
Using obscure message formatting features, this allows out-of-bound memory writes, which can be used to cause crashes.
This vulnerability affects users working on Windows machines to which other, untrusted parties have write access. Typically, all authenticated users have permission to create folders in
C:\, allowing for malicious actors to inject incorrect messages into
A similar vulnerability (as above) exists in Git for Windows’s
connect.exe executable, which is responsible for implementing a SOCKS5 proxy.
The location of connect.exe’s configuration file is hard-coded to a path that is typically interpreted as
C:\etc\connectrc, which is susceptible in a similar fashion as above. Users on multi-account Windows machines are highly advised to exercise caution if they use this SOCKS5 proxy on those machines.
Lastly, Git for Windows’s “Git CMD” program incorrectly searches for a program called
doskey.exe beginning in the working directory of Git CMD on startup. When started in untrusted directories, this can lead to silent arbitrary code execution.
This vulnerability is similar to the one that led to Git CMD being deprecated temporarily in Git for Windows v2.19.2, but is contained to the directory in which Git CMD is started.
Upgrade to the latest Git version
The most effective way to protect against these vulnerabilities is to upgrade to Git 2.40.1. If you can’t update immediately, reduce your risk by taking the following steps:
- Avoid using
git apply --rejectwhen working with patches from untrusted sources. Use
git apply --statto inspect a patch before applying it.
- Avoid running
git submodule deinit,
git config --rename-section, and
git config --remove-sectionon untrusted repositories or without prior inspection of your
On Windows, you can reduce your risk by doing the following:
- Avoid using Git for Windows on machines with shared accounts. Otherwise, create empty
C:\etcfolders, and remove any write permission on them.
- Avoid using Git CMD, or if doing so is impossible, ensure it is started from a trusted directory.
In order to protect users against these attacks, GitHub has taken proactive steps. Specifically, we:
- Scheduled a GitHub Desktop release for tomorrow, April 26, 2023, that prevents the exploitation of this vulnerability.
- Scheduled updates to GitHub Codespaces and GitHub Actions to upgrade their versions of Git.
GitHub itself is not affected by these vulnerabilities. We do not use
git apply --reject, nor Git’s configuration mechanism. GitHub does not use Git for Windows, and is thus not affected by those vulnerabilities, either.
CVE-2023-25652 was found by RyotaK, and CVE-2023-29007 was found by André Baptista and Vítor Pinho of Ethiack. The fixes for CVE-2023-25652 were developed by Johannes Schindelin, Taylor Blau, and Junio C Hamano, with help from Linus Torvalds. The fixes for CVE-2023-29007 were developed by Taylor Blau, Jeff King, Patrick Steinhardt, and Johannes Schindelin.
CVE-2023-25815 was discovered by Maxime Escourbiac and Cousky. Both CVE-2023-29011 and CVE-2023-29012 were discovered by ycdxsb. Fixes for all three of these vulnerabilities were developed by Johannes Schindelin.