CVE-2024-24577: Libgit2 RCE Vulnerability

CVE-2024-24577 Overview

CVE-2024-24577 is a critical heap corruption vulnerability in libgit2, a portable C implementation of the Git core methods provided as a linkable library. The vulnerability exists in the has_dir_name function within src/libgit2/index.c, where a use-after-free condition can be triggered through crafted inputs to the git_index_add function. This flaw allows attackers to achieve arbitrary code execution by manipulating freed memory with attacker-controlled data.

Critical Impact

This vulnerability enables remote attackers to execute arbitrary code on systems running applications that utilize vulnerable versions of libgit2, potentially leading to complete system compromise.

Affected Products

• libgit2 versions prior to 1.6.5
• libgit2 versions 1.7.x prior to 1.7.2
• Applications and libraries built using vulnerable libgit2 versions

Discovery Timeline

• 2024-02-06 - CVE-2024-24577 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24577

Vulnerability Analysis

This vulnerability represents a classic use-after-free memory corruption issue in a critical software library. The flaw resides in the index handling code of libgit2, specifically within the has_dir_name function located in src/libgit2/index.c. When processing maliciously crafted inputs through the git_index_add function, the library incorrectly frees an index entry that remains in use. Subsequent operations on this freed entry allow an attacker to overwrite the memory with controlled data, resulting in heap corruption that can be weaponized for arbitrary code execution.

The severity of this vulnerability is amplified by libgit2's widespread adoption. As a foundational library, it is integrated into numerous applications, development tools, and Git-related services. Any application leveraging the vulnerable git_index_add functionality may be susceptible to exploitation.

Root Cause

The root cause is an improper memory management error (CWE-122: Heap-based Buffer Overflow, CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the has_dir_name function. The function prematurely frees an index entry while references to that entry still exist in the application's execution context. This dangling pointer is later dereferenced and written to, enabling controlled heap corruption.

Attack Vector

The attack is network-exploitable and requires no user interaction or authentication. An attacker can craft malicious input data designed to trigger the vulnerable code path in git_index_add. When an application processes this input—such as when indexing files from a malicious repository or handling crafted Git data—the use-after-free condition is triggered.

The exploitation mechanism involves:

1. Providing specially crafted input to trigger the git_index_add function
2. The has_dir_name function incorrectly frees an entry that should remain allocated
3. The freed memory region is subsequently reused and populated with attacker-controlled data
4. Later access to the freed entry results in controlled heap corruption
5. Depending on heap layout and application behavior, this can lead to arbitrary code execution

For detailed technical information, refer to the GitHub Security Advisory GHSA-j2v7-4f6v-gpg8.

Detection Methods for CVE-2024-24577

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications using libgit2
• Abnormal memory allocation patterns or heap corruption errors in application logs
• Suspicious Git repository data or index files with malformed entries
• Unexpected child processes spawned by Git-related applications

Detection Strategies

• Implement runtime memory corruption detection tools (e.g., AddressSanitizer, Valgrind) during development and testing phases
• Monitor application crash dumps for heap corruption signatures associated with libgit2 functions
• Deploy endpoint detection and response (EDR) solutions capable of identifying memory exploitation techniques
• Scan software inventories for applications built against vulnerable libgit2 versions (< 1.6.5 or 1.7.x < 1.7.2)

Monitoring Recommendations

• Enable application crash reporting and analyze dumps for exploitation indicators
• Configure intrusion detection systems to alert on anomalous Git-related network traffic
• Implement file integrity monitoring on systems processing untrusted Git repositories
• Track and inventory all deployments of libgit2-dependent applications across the environment

How to Mitigate CVE-2024-24577

Immediate Actions Required

• Upgrade libgit2 to version 1.6.5 or 1.7.2 immediately
• Identify all applications and dependencies utilizing libgit2 and ensure they are rebuilt against patched versions
• Restrict processing of untrusted Git repository data until patches are applied
• Enable exploit mitigation features such as ASLR, DEP, and stack canaries on affected systems

Patch Information

The libgit2 project has released patched versions that address this vulnerability:

• Version 1.6.5: GitHub Release v1.6.5
• Version 1.7.2: GitHub Release v1.7.2

Linux distribution users should apply updates from their respective package repositories:

• Debian LTS Announcement
• Fedora Package Announcements

Workarounds

• Isolate systems running vulnerable libgit2 versions from processing untrusted Git data
• Implement network segmentation to limit exposure of vulnerable applications
• Apply application-level sandboxing to restrict the impact of potential exploitation
• Deploy Web Application Firewalls (WAF) with rules to inspect and filter malicious Git-related traffic

# Verify installed libgit2 version
pkg-config --modversion libgit2

# Update libgit2 on Debian/Ubuntu systems
sudo apt update && sudo apt upgrade libgit2-1.1

# Update libgit2 on Fedora systems
sudo dnf update libgit2