CVE-2016-2315

What it actually does

Incorrect integer type in revision.c leads to heap-based buffer overflow when processing long filenames or deeply nested trees, enabling remote arbitrary code execution.

Why it matters to the business

Compromised development systems and source code repositories allow attackers to inject malware, steal intellectual property, or disrupt software supply chains; high prevalence of Git across organizations amplifies exposure.

How an attack unfolds

Attacker publishes a malicious Git repository containing either an extremely long filename or many levels of nested trees; when a victim clones, fetches, or otherwise processes the repo with a vulnerable Git client, the integer mishandling in revision.c triggers the heap overflow and executes attacker-supplied code.

How to fix it

Upgrade Git to a version containing commit 34fa79a6cde56d6d428ab0d3160cb094ebad3305 (equivalent to 2.7.4 or later). Rebuild any custom packages or containers that embed the vulnerable Git binary. Remove or isolate any remaining vulnerable installations.

How to confirm the fix worked

Run 'git --version' on all systems and confirm the installed version is 2.7.4 or newer; attempt to clone a test repository containing a filename longer than 2^31 characters or a tree depth exceeding the previous integer limit and verify no crash or unexpected behavior occurs.

Typical attack path

1. Create or modify a Git repository with crafted long filename or deeply nested tree objects
2. Host the malicious repository on a publicly reachable server or induce the victim to add it as a remote
3. Victim performs clone, fetch, or ls-remote operation against the repository
4. revision.c integer mishandling causes heap overflow and attacker code execution on the victim system

How to detect it

Review Git client logs and system process crash dumps for sudden terminations or segmentation faults during clone/fetch operations; correlate with repository names containing unusually long paths or deep nesting; examine command history for unexpected Git invocations from untrusted sources.

What your security team should do

• Immediately upgrade all Git installations to the fixed commit or 2.7.4+ release
• Scan build pipelines and CI systems for embedded vulnerable Git binaries and replace them
• Add Git version checks to software bill-of-materials and dependency scanning tools
• Monitor for any post-upgrade anomalies in repository operations