Cloudanix VulnDB

CVE-2017-15298

Medium · 5.5

CVSS

5.5

EPSS

1.6%

Published

Oct 14, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how certain software handles specially made data collections can make computers run out of memory when opening files from untrusted sources, potentially stopping work until the system is restarted.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability allows a crafted Git repository with deeply nested tree objects to trigger excessive memory allocation during object processing, leading to denial of service; secondary disk consumption may occur if the process survives.

Why it matters to the business

Systems handling untrusted repositories can become unavailable or exhaust resources, disrupting development workflows and requiring manual intervention to restore service; older browser packages on Debian and Ubuntu are affected but have long-standing fixes available.

How an attack unfolds

An attacker creates a malicious repository containing layered tree objects designed to expand dramatically in memory, then tricks a victim into cloning or processing the repository with an affected Git client, causing the process to consume all available memory.

How to fix it

Upgrade affected packages to the listed fixed versions: firefox-esr on Debian 11/12/13 to 45.8.0esr-1, firefox on Ubuntu 14.04 LTS to 52.0+build2-0ubuntu0.14.04.1, and thunderbird on Ubuntu 14.04 LTS to 1:45.8.0+build1-0ubuntu0.14.04.1; avoid processing untrusted repositories until updated.

How to confirm the fix worked

Confirm Git client version is newer than 2.14.2 and test by attempting to process a known non-exploitable repository; verify package installation matches the fixed versions provided for each distribution.

Typical attack path

  1. Attacker generates a specially crafted Git repository with excessive tree object layers
  2. Attacker distributes the repository via public hosting, email, or supply chain
  3. Victim clones or fetches from the repository using an unpatched Git version
  4. Git client attempts to build the in-memory data structure and exhausts system memory

How to detect it

Review system logs for Git processes terminating with out-of-memory errors or excessive resource usage; search historical clone or fetch logs for repositories with unusually deep or repetitive tree structures.

What your security team should do

  • Prioritize patching any remaining systems still running the listed vulnerable browser packages
  • Implement repository scanning or size limits before allowing clones in CI/CD pipelines
  • Monitor for unusually high memory usage during Git operations as a general control

The record

Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 git 0 1:2.16.1-1
Debian:11 git 0 1:2.16.1-1
Debian:12 git 0 1:2.16.1-1
Debian:13 git 0 1:2.16.1-1
Debian:14 git 0 1:2.16.1-1
Mageia:5 git 0 2.7.6-1.1.mga5
Mageia:6 git 0 2.13.6-1.1.mga6
SUSE:Linux Enterprise Module for Basesystem 15 SP1 git 0 2.26.1-3.25.2
SUSE:Linux Enterprise Module for Development Tools 15 SP1 git 0 2.26.1-3.25.2
Ubuntu:14.04:LTS git 0 1:1.9.1-1ubuntu0.10
Ubuntu:16.04:LTS git 0 1:2.7.4-0ubuntu1.6
Ubuntu:18.04:LTS git 0 1:2.17.0-1ubuntu1
Ubuntu:18.04:LTS git 0 1:2.17.1-1ubuntu0.4
openSUSE:Leap 15.1 git 0 2.26.1-lp151.4.9.1
openSUSE:Tumbleweed git 0 2.33.0-1.3

Related vulnerabilities