To re-enable that use case, we add support for adding exceptions from the new default behavior via the config setting safe.directory. This new default behavior is obviously incompatible with the concept of shared repositories, where we expect the top-level directory to be owned by only one of its legitimate users. ![]() We avoid looking at the ownership of each and every directory between the current and the top-level one (if there are any between) to avoid introducing a performance bottleneck. To plug this vulnerability, we stop Git from accepting top-level directories owned by someone other than the current user. The same holds true in multi-user setups running Windows, as C:\ is writable to every authenticated user by default. Git-enabled PS1 when there is a maliciously-crafted /scratch/.git/ in computer pools of educational institutes to have a "scratch" space: a mounted disk with plenty of space that is regularly swiped where any authenticated user can create a directory to do their work. It poses a security risk to search for a git directory outside of the directories owned by the current user.įor example, it is common e.g. So the "someone else" is: anyone having access to your computer, and in a folder which is not explicitly listed as "safe". On Windows, for example, an attacker could create C:\.git\config, which would cause all git invocations that occur outside a repository to read its configured values.īy default, Git will refuse to even parse a Git config of a repository owned by someone else, let alone run its hooks, and this config setting allows users to specify exceptions, e.g. git directory in a shared location above a victim’s current working directory. As the Git team noted: “Please update at your earliest opportunity.A malicious actor could create a. Ultimately, if you can, then patching seems the best way to go. The code shack gave a hattip to 俞晨东 for finding the bug and Johannes Schindelin for working on a fix. git folder themselves and remove read/write access as workaround or “define or extend ‘GIT_CEILING_DIRECTORIES’ to cover the parent directory of the user profile,” according to NIST. To deal with the issue, the Git team recommends an update. Git for Windows is uniquely not vulnerable to this security issue: this vulnerability requires writing a file to disk, and that filename must be particularly formatted and include a colon. ![]() To test this code review tool, you can either explore the demo on their website or download and set up the software on your server. These need to be multi-user machines, likely running Windows (probably due to how the file system of the OS works.) Ultimately, it is an arbitrary code issue, if one that requires access to the disk to implement. Review Board is a web-based, open source tool for code review. Not nice, but also very specific in terms of affected systems. The Git team was little blunter about the vulnerability, and warned that “Merely having a Git-aware prompt that runs ‘git status’ (or ‘git diff’) and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user.” “Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash.” NIST went on to list potentially vulnerable products, which included Visual Studio. The result is that Git would use the config in the directory. ![]() In this case, the miscreants would only need to create the folder c.git, “which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory,” according to NIST. The vulnerability affects multi-user hardware where untrusted parties have write access to the same hard disk.Īrguably, if an “untrusted party” has write access to a hard disk, then all bets are off when it comes to the nooks and crannies of a PC anyway. The update is solely concerned with CVE-2022-24765, an interesting bug which afflicts the Git for Windows fork of Git. These include the latest maintenance release, 2.35.2, along with updates for older maintenance tracks (v2.30.3, v2.31.2, v2.32.1, v2.33.2, and v2.34.2.) After a hefty Patch Tuesday comes news of an update for Git to deal with a vulnerability for the source shack when run on Microsoft’s Windows.Ī variety of releases were emitted by the team.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |