A Security-Focused Git Release: Version 2.45.1

On May 14, 2024, the Git project released version 2.45.1, a security-focused update that patches five distinct vulnerabilities. The release covers Windows, macOS, Linux, and *BSD platforms. It also reaches downstream tools, as this update is coordinated with Visual Studio and GitHub Desktop, which bundle Git internally. In addition to the direct vulnerability fixes, this release comes with several defense-in-depth updates aimed at reducing the impact of future, related issues.

Critical and High-Severity Flaws

Two of the five fixes address remote code execution (RCE) vectors. The first, CVE-2024-32002, is rated critical and affects Windows and macOS systems. It exploits repositories that use submodules. By crafting a repository with a combination of a directory and a symlink that differ only in case, an attacker can trick Git into writing files into a .git/ directory instead of the submodule's worktree. This can be leveraged to install a hook that Git executes while the clone is still in progress, leaving the user with no chance to review the code before it runs.

The second RCE flaw, CVE-2024-32004, carries a high severity rating and is a risk on multi-user machines. Here, an attacker prepares a local repository to look like a partial clone that is missing an object. When another user clones this repository, the flaw allows the attacker's code to execute with the full permissions of the user performing the clone.

A third high-severity issue, CVE-2024-32465, concerns cloning from .zip files that contain a full Git repository. Downloading a repository in this format can be risky, as the hooks contained within such an archive are not inherently safe. While Git's documented position remains that cloning an untrusted repository is a safe way to "sanitize" it, this bug demonstrates that the protections for such operations were not always sufficient.

Local Clone Risks on Multi-User Systems

The remaining two fixes address lower-severity issues that surface when cloning local repositories on the same disk. CVE-2024-32020 relates to how Git hard-links files when the source and target of a clone reside on the same filesystem. If the source repository is owned by another user, that user could later modify the hard-linked files in the new repository's object database.

CVE-2024-32021 involves cloning a source repository that contains symbolic links. Git may create hard-links in the target's objects/ directory that point to arbitrary files on the same filesystem. This specific behavior could be used in a more complex attack to get Git to write data outside of the worktree and .git/ directory.

Defense-in-Depth Changes

The Git contributors observed a recurring pattern across recent security releases: submodule support is a frequent weakness, and the presence of hooks is what escalates the severity of these findings to high or critical. To counter this trend, the release includes hardening measures that aim to reduce the damage from similar future vulnerabilities:

  • Improvements to how symbolic links and directories are handled during clone operations.
  • More secure execution of hooks, which prevents unauthorized scripts from running automatically.
  • Protection for the Git templates directory configuration setting, which can influence which hooks run.
  • New warnings when symbolic links point inside the .git/ directory, with an option to treat these warnings as errors for stricter security.

Upgrade and Compatibility Notes

Upgrading to Git v2.45.1 is strongly recommended to protect against these vulnerabilities. If an immediate upgrade is not possible, users should exercise caution when cloning from untrusted sources. One regression has been identified in this release: cloning a repository with Git LFS may fail with an error, which can be resolved by running git lfs pull in the existing fresh clone.