Arbitrary Code Execution Vulnerability in libgit2 Could Lead to Controlled Heap Corruption
CVE-2024-24577
8.6HIGH
What is CVE-2024-24577?
The vulnerability involves a flaw in the libgit2 library, specifically within the has_dir_name function located in src/libgit2/index.c. This flaw arises when the function improperly frees an entry that should remain allocated. Consequently, this freed entry is later reused and overwritten with potentially malicious data, resulting in controlled heap corruption. Applications leveraging libgit2 may be susceptible to arbitrary code execution if they accept carefully crafted inputs when calling git_index_add. It is crucial for developers to apply the available patches provided in versions 1.6.5 and 1.7.2 of libgit2 to mitigate this vulnerability.
Affected Version(s)
libgit2 < 1.6.5 < 1.6.5
libgit2 >= 1.7.0, < 1.7.2 < 1.7.0, 1.7.2