Git security audit reveals critical overflow bugs

Uncovered vulnerabilities include several high, medium, and low-security issues

A security audit of the source code for Git has revealed several vulnerabilities, including two critical overflow bugs.

The audit, sponsored by the Open Source Technology Improvement Fund (OSTIF) and performed by X41 D-Sec and GitLab, also included several high, medium, and low-severity issues.

Given the popularity of Git and its integration into popular packaging systems, the vulnerabilities could have an immense impact on the security of the software supply chain.

Evil clone operation

The most severe flaw the researchers discovered was a memory corruption bug that could be triggered when Git parses the file of a repository. Developers use to customize how Git handles different files and file paths in repositories, such as line endings, file encodings, and more.

The researchers discovered that if contained a very long attribute line or many attribute lines, it would cause a counter overflow in the function that parses the file and lead to arbitrary code execution.

LIKE THE DAILY SWIG? Tell us what you think for the chance to win Burp Suite swag

An attacker could exploit the bug by committing a malicious file to a repository. The bug would be triggered when the victim called or on the repository.

Since the bug requires no special arguments or commands on the victim’s computer, it could become an important part of dangerous supply chain attacks.

“If [attackers] could stage it on a popular library, they could have an impact on the git clients using it, which might also involve anyone using common package systems to install software,” Markus Vervier, managing director at X41 D-Sec, told The Daily Swig.

The bug could also be used to exploit the Git servers such as GitHub or GitLab, Vervier said – though he added that both GitLab and GitHub itself have already been patched.

Pretty but malicious

The second critical bug the researchers discovered would allow code execution during archive operations commonly performed by Git forges such as GitHub and GitLab.

The and commands can display commits using pretty formatting. When processing the padding operators, an integer overflow can occur in the pretty format parser if a special format specifier pattern is used.

The overflow bug is triggered directly if a user runs the command with the specifier, or indirectly if the command is called via the mechanism.

Read more of the latest news about DevSecOps

An attacker could trigger the bug through an argument injection to the command, confirmed GitLab security engineer Joern Schneeweisz in comments to The Daily Swig. But the more interesting attack vector was the operation, he said.

The attacker could include an statement in the file within a repository. It would trigger the bug by a command without the need for any injected arguments, Schneeweisz said.

“The payload would be self-contained within the repository and triggered by calling ,” Schneeweisz said. “Running on arbitrary repositories is a very common thing for Git forges like GitLab or GitHub, so this issue is mostly an RCE [remote code execution] threat to those.”

The supply chain threat

In addition to the critical vulnerabilities, the researchers found many integer-related issues that could lead to denial-of-service, out-of-bound reads, or simply badly handled corner cases on large input. Vervier said that the findings were very relevant to the security of software supply chains.

“Git is basically the ultimate supply chain attack vector in the current IT landscape since it is heavily used even for package managers such as Rust/Cargo, Golang, NodeJS, and others. It is also the most widely used source code versioning tool for development,” he said.

RECOMMENDED READING Squaring the CircleCI: DevOps platform publishes post-mortem on recent breach