Git Project Patches Two Security Flaws

The Git project has released new versions addressing two security vulnerabilities. While GitHub is unaffected by either issue, local installations—particularly Git for Windows and Git on multi-user machines—should be updated promptly.

Malicious Config Injection on Shared Systems

The first vulnerability, CVE-2022-24765, targets users on multi-user machines. An attacker could create a .git directory in a shared location above a victim's working directory—for example, C:\.git\config on Windows—causing all git commands run outside of a repository to read the attacker-controlled configuration.

Because certain configuration variables like core.fsmonitor can cause Git to execute arbitrary commands, this flaw could lead to command execution on shared systems.

Upgrading to Git v2.35.2 is the most effective fix. This release changes how Git searches for a top-level .git directory: traversal now stops when the directory ownership changes from the current user. If an exception is needed, the new multi-valued safe.directory configuration option is available.

For those who cannot upgrade immediately, risk can be reduced by:

  • Setting the GIT_CEILING_DIRECTORIES environment variable to the parent directory of the user profile (/Users on macOS, /home on Linux, or C:\Users on Windows).
  • Avoiding Git on multi-user machines when the current working directory is outside a trusted repository.

Keep in mind that tools such as Git Bash in Git for Windows, posh-git, and Visual Studio invoke Git commands automatically. On multi-user systems, refrain from using these tools until the latest release is installed. The vulnerability was reported by 俞晨东.

Uninstaller DLL Hijacking on Windows

The second vulnerability, CVE-2022-24767, affects the Git for Windows uninstaller, which runs in the user's temporary directory. Since the SYSTEM account inherits the default world-writable permissions of C:\Windows\Temp, any authenticated user can place malicious .dll files. These are loaded when the uninstaller runs under the SYSTEM account.

Upgrading to Git for Windows v2.35.2 is the recommended protection. If an immediate upgrade is not possible, the following steps reduce exposure:

  • Delay running the uninstaller until after upgrading.
  • Override the SYSTEM user's TMP environment variable to a directory writable only by SYSTEM.
  • Delete unknown .dll files from C:\Windows\Temp before running the uninstaller.
  • Run the uninstaller under an administrator account rather than as the SYSTEM user.

The issue was discovered by the Lockheed Martin Red Team.