Cloudanix VulnDB

CVE-2016-8568

Medium · 5.5

CVSS

5.5

EPSS

1.9%

Published

Feb 3, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a common library for reading git data can let an attacker crash programs by feeding them a specially made file, which may briefly interrupt services that rely on that library.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in the git_commit_message function of oid.c in libgit2 allows an attacker-supplied crafted object file processed via cat-file to trigger a denial of service crash without requiring elevated privileges.

Why it matters to the business

Applications that embed vulnerable libgit2 versions can be forced offline or become unresponsive when handling untrusted git objects, interrupting developer workflows and any automated git-dependent pipelines until the process is restarted.

How an attack unfolds

An attacker creates a specially crafted git object file that triggers the vulnerable git_commit_message path, then invokes the cat-file command (or equivalent API usage) against it; the resulting out-of-bounds read crashes the process. The attack requires local execution or user interaction and has no known named threat-actor campaigns associated with it.

How to fix it

Upgrade libgit2 to version 0.24.3 or later. For the listed packages apply the exact fixes: tigera-operator-1.33 (Chainguard) to 1.33.0-r1 and tigera-operator-1.33 (Wolfi) to 1.33.0-r1.

How to confirm the fix worked

Confirm the installed libgit2 version is at least 0.24.3; attempt to process a known-bad crafted object with cat-file and verify the process no longer crashes; re-run any package scanners against the fixed versions listed above.

Typical attack path

  1. Craft a malicious git object file designed to reach git_commit_message with invalid offsets
  2. Invoke cat-file (or an application API that calls it) against the crafted object
  3. Trigger the out-of-bounds read that leads to a crash or denial of service

How to detect it

Search application and system logs for abrupt crashes or segmentation faults in processes that use libgit2, especially around git object handling or cat-file invocations; correlate with any recent introduction of untrusted git repositories or objects.

What your security team should do

  • Immediately upgrade all instances of the affected tigera-operator packages to the stated fixed versions
  • Inventory other products that statically or dynamically link libgit2 and schedule upgrades
  • Add libgit2 version checks to CI/CD and container build pipelines

The record

The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.

Affected packages

Ecosystem Package Introduced Fixed
Alpine:v3.10 libgit2 0 0.24.3-r0
Alpine:v3.11 libgit2 0 0.24.3-r0
Alpine:v3.5 libgit2 0 0.24.3-r0
Alpine:v3.6 libgit2 0 0.24.3-r0
Alpine:v3.7 libgit2 0 0.24.3-r0
Alpine:v3.8 libgit2 0 0.24.3-r0
Alpine:v3.9 libgit2 0 0.24.3-r0
Debian:11 cargo 0 0.17.0-1
Debian:11 libgit2 0 0.24.5-1
Debian:12 cargo 0 0.17.0-1
Debian:12 libgit2 0 0.24.5-1
Debian:13 libgit2 0 0.24.5-1
Mageia:5 libgit2 0 0.21.1-3.2.mga5
SUSE:Linux Enterprise Software Development Kit 12 SP2 libgit2 0 0.24.1-3.1
SUSE:Package Hub 12 SP1 libgit2 0 0.24.3-6.1
Ubuntu:18.04:LTS libgit2 0 0.26.0+dfsg.1-1.1build1
Ubuntu:Pro:14.04:LTS libgit2 0 0.19.0-2ubuntu0.4+esm1
Ubuntu:Pro:16.04:LTS libgit2 0 0.24.1-2ubuntu0.2+esm1
openSUSE:Tumbleweed libgit2 0 0.24.3-1.1

Related vulnerabilities