CVE-2022-39260 - CVE House

Back to Database

Status published High CVE-2022-39260

Git vulnerable to Remote Code Execution via Heap overflow in `git shell`

8.5 CVSS

Vulnerability Description

Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the number of entries in the array, allowing a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting array is then passed to `execv()`, it is possible to leverage this attack to gain remote code execution on a victim machine. Note that a victim must first allow access to `git shell` as a login shell in order to be vulnerable to this attack. This problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 and users are advised to upgrade to the latest version. Disabling `git shell` access via remote logins is a viable short-term workaround.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39260

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from git

View All →

Git allows a buffer overflow in 'wincred' credential helper

Git alllows arbitrary file writes via bundle-uri parameter injection

Git allows arbitrary code execution through broken config quoting

Newline confusion in credential helpers can lead to credential exfiltration in git

The sideband payload is passed unfiltered to the terminal in git

Affected Vendor

git

View all reports →

Affected Software

git

Vulnerable Versions:

< 2.30.6, > 2.31.0, < 2.31.5, > 2.32.0, < 2.32.4, > 2.33.0, < 2.33.5, > 2.34.0, < 2.34.5, > 2.34.0, < 2.35.5, > 2.35.0, < 2.36.3, > 2.37.0, < 2.37.4

Timeline

Official Publish: October 19th, 2022

Last Modified: August 3rd, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-787 CWE-122

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control

T1485 Data Destruction

T1203 Exploitation for Client Execution