libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA libgit2 (libgit2) Fixed in 1.6.5, 1.7.2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2024-24577
References
Other 8
- https://github.com/libgit2/libgit2/releases/tag/v1.6.5
- https://github.com/libgit2/libgit2/releases/tag/v1.7.2
- https://lists.fedoraproject.org/archives/list/[email protected]/message/S635BGHHZUMRPI7QOXOJ45QHDD5FFZ3S/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4M3P7WIEPXNRLBINQRJFXUSTNKBCHYC7/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7CNDW3PF6NHO7OXNM5GN6WSSGAMA7MZE/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/Z6MXOX7I43OWNN7R6M54XLG6U5RXY244/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZGNHOEE2RBLH7KCJUPUNYG4CDTW4HTBT/
- https://lists.debian.org/debian-lts-announce/2024/02/msg00012.html
More Libgit2 vulnerabilities
- TI-2014-07619 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x… CVSS 3.1CRITICAL 9.8
- TI-2020-09811 An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. CVSS 3.1CRITICAL 9.8
- TI-2020-09810 An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. CVSS 3.1CRITICAL 9.8
- TI-2018-11055 In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a… CVSS 3.1HIGH 7.5
- TI-2018-07700 Out-of-bounds read in libgit2 CVSS 3.1HIGH 8.1
- TI-2024-16196 libgit2 is vulnerable to a denial of service attack in `git_revparse_single` CVSS 3.1HIGH 7.5
Sources
- CVE-2024-24577 · CVE Program
- CVE-2024-24577 · NVD
- FIRST EPSS
- CVE-2024-24577 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences