Summary
In eza, there exists a potential heap overflow vulnerability, first seen when using Ubuntu for Raspberry Pi series system, on ubuntu-raspi kernel, relating to the .git directory.
Details
The vulnerability seems to be triggered by the .git directory in some projects. This issue may be related to specific files, and the directory structure also plays a role in triggering the vulnerability. Files/folders that may be involved in triggering the vulnerability include .git/HEAD, .git/refs, and .git/objects.
As @polly pointed out to me, this is likely caused by GHSA-j2v7-4f6v-gpg8, which we do seem to use currently.
PoC
For more information check @CuB3y0nd's blogpost blog.
Impact
Arbitrary code execution.
References
CuB3y0nd Finder
FuzzyLitchi Analyst
cafkafk Remediation reviewer
inspector-ambitious Analyst
Summary
In
eza, there exists a potential heap overflow vulnerability, first seen when using Ubuntu for Raspberry Pi series system, onubuntu-raspikernel, relating to the.gitdirectory.Details
The vulnerability seems to be triggered by the
.gitdirectory in some projects. This issue may be related to specific files, and the directory structure also plays a role in triggering the vulnerability. Files/folders that may be involved in triggering the vulnerability include.git/HEAD,.git/refs, and.git/objects.As @polly pointed out to me, this is likely caused by GHSA-j2v7-4f6v-gpg8, which we do seem to use currently.
PoC
For more information check @CuB3y0nd's blogpost blog.
Impact
Arbitrary code execution.
References