CVE-2023-25815

Name
CVE-2023-25815
Description
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`.
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1
MISC https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack
MISC https://github.com/msys2/MINGW-packages/pull/10461
MISC https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html
MISC https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8
MISC http://www.openwall.com/lists/oss-security/2023/04/25/2
MISC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/
MISC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/
MISC https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/
security-advisories@github.com https://security.gentoo.org/glsa/202312-15

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:git_for_windows_project:git_for_windows:*:*:*:*:*:*:*:* git_for_windows >= None < 2.40.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
git 3.17-main 2.38.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
git 3.16-main 2.36.6-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
git 3.15-main 2.34.8-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
git 3.14-main 2.32.7-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
git 3.18-main 2.40.1-r0 Natanael Copa <ncopa@alpinelinux.org> fixed