CVE-2024-25817

What it actually does

Buffer overflow in eza's handling of .git/HEAD, .git/refs, and .git/objects allows local attackers to overwrite memory and execute arbitrary code.

Why it matters to the business

Attackers with local access can gain full control of affected systems, leading to data theft, persistence, or lateral movement; low prevalence and lack of known exploitation reduce immediate risk but unpatched developer workstations remain exposed.

How an attack unfolds

An attacker creates or modifies a local git repository containing oversized or malformed data in .git/HEAD, .git/refs, or .git/objects; when eza parses the repository it triggers the buffer overflow, allowing shellcode execution in the process context.

How to fix it

Upgrade eza to version 0.18.2 or later; verify the installed version with 'eza --version' and replace any older binary or package installation.

How to confirm the fix worked

Run 'eza --version' to confirm 0.18.2 or newer; test eza against a repository containing large .git metadata to ensure no crash or unexpected behavior occurs.

Typical attack path

1. Obtain local access to a system where eza is executed against git repositories
2. Craft a malicious git repository with oversized content in .git/HEAD, .git/refs, or .git/objects
3. Execute eza against the repository to trigger the buffer overflow
4. Achieve arbitrary code execution within the eza process

How to detect it

Monitor for eza process crashes or segmentation faults when accessing git repositories; review shell history and file access logs for unexpected eza invocations against unknown repositories.

What your security team should do

• Immediately update all eza installations to 0.18.2 or newer across developer and CI environments
• Inventory systems using eza via package managers or process monitoring
• Restrict untrusted git repositories from being parsed by eza until patched