Read the docs
TI-2024-21115 Aliases CVE-2024-32020

Cloning local Git repository by untrusted user allows the untrusted user to modify…

Priority LOW 19CWE-281Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 3 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a "proper" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00519 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial git (git): 2.43.4, 2.42.2, 2.40.2 +1Red Hat: 3 advisoriesRed Hat: 3 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Gitgit= 2.45.0; = 2.44.0; 2.43.0 to before 2.43.4; 2.42.0 to before 2.42.2; = 2.41.0; 2.40.0 to before 2.40.2; before 2.39.42.43.4, 2.42.2, 2.40.2, 2.39.4Patch availableCNA
  • git VendorGit Affected = 2.45.0; = 2.44.0; 2.43.0 to before 2.43.4; 2.42.0 to before 2.42.2; = 2.41.0; 2.40.0 to before 2.40.2; before 2.39.4 Fixed in 2.43.4, 2.42.2, 2.40.2, 2.39.4 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*before 2.39.4; 2.40.0 to before 2.40.2; 2.42.0 to before 2.42.2; 2.43.0 to before 2.43.4VulnerableGit-scm
cpe:2.3:a:git-scm:git:2.41.0:*:*:*:*:*:*:*2.41.0VulnerableGit-scm
cpe:2.3:a:git-scm:git:2.44.0:*:*:*:*:*:*:*2.44.0VulnerableGit-scm
cpe:2.3:a:git-scm:git:2.45.0:*:*:*:*:*:*:*2.45.0VulnerableGit-scm
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*40VulnerableFedoraproject
  • cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* Versions before 2.39.4; 2.40.0 to before 2.40.2; 2.42.0 to before 2.42.2; 2.43.0 to before 2.43.4 Vulnerable ·Git-scm
  • cpe:2.3:a:git-scm:git:2.41.0:*:*:*:*:*:*:* Versions 2.41.0 Vulnerable ·Git-scm
  • cpe:2.3:a:git-scm:git:2.44.0:*:*:*:*:*:*:* Versions 2.44.0 Vulnerable ·Git-scm
  • cpe:2.3:a:git-scm:git:2.45.0:*:*:*:*:*:*:* Versions 2.45.0 Vulnerable ·Git-scm
  • cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA git (git) Fixed in 2.43.4, 2.42.2, 2.40.2, 2.39.4

Red Hat 3 advisories

  • RHSA-2024:4368 Released 2024-07-08 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) git-2.39.5-1.el9_2, git-all-2.39.5-1.el9_2, git-core-2.39.5-1.el9_2 +12
  • RHSA-2024:4083 Released 2024-06-25 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 9) git-2.43.5-1.el9_4, git-all-2.43.5-1.el9_4, git-core-2.43.5-1.el9_4 +12
  • RHSA-2024:4084 Released 2024-06-25 · Red Hat rating Important
    git security update
    • Red Hat Enterprise Linux AppStream (v. 8) git-2.43.5-1.el8_10, git-all-2.43.5-1.el8_10, git-core-2.43.5-1.el8_10 +12

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat Software CollectionsAffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:4084
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:4083
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:4368

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32020

References

Exploit 1

Patch 2

Advisory 2

  • TI-2025-30709 Git allows arbitrary code execution through broken config quoting KEVCVSS 3.1HIGH 8.1
  • TI-2022-07580 gitattributes parsing integer overflow in git CVSS 3.1CRITICAL 9.8
  • TI-2022-20244 Integer overflow in `git archive`, `git log --format` leading to RCE in git CVSS 3.1CRITICAL 9.8
  • TI-2021-04400 malicious repositories can execute remote code while cloning CVSS 3.1HIGH 8.0
  • TI-2024-21101 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution CVSS 3.1CRITICAL 9.1
  • TI-2023-10933 "git apply --reject" partially-controlled arbitrary file write CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences