Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zcXgzLTZoeHItajJjaM4AA5Ks

eza Potential Heap Overflow Vulnerability for AArch64

Summary

In eza, there exists a potential heap overflow vulnerability, first seen when using Ubuntu for Raspberry Pi series system, on ubuntu-raspi kernel, relating to the .git directory.

Details

The vulnerability seems to be triggered by the .git directory in some projects. This issue may be related to specific files, and the directory structure also plays a role in triggering the vulnerability. Files/folders that may be involved in triggering the vulnerability include .git/HEAD, .git/refs, and .git/objects.

As @polly pointed out to me, this is likely caused by GHSA-j2v7-4f6v-gpg8, which we do seem to use currently.

PoC

For more information check @CuB3y0nd's blogpost blog.

Impact

Arbitrary code execution.

Permalink: https://github.com/advisories/GHSA-3qx3-6hxr-j2ch
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcXgzLTZoeHItajJjaM4AA5Ks
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 3 months ago
Updated: about 2 months ago

CVSS Score: 8.4
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-3qx3-6hxr-j2ch, CVE-2024-25817
References:

• https://github.com/eza-community/eza/security/advisories/GHSA-3qx3-6hxr-j2ch
• https://github.com/eza-community/eza/commit/47c9b90368c49117ba42760bd58acafa3362cbd4
• https://github.com/advisories/GHSA-3qx3-6hxr-j2ch

Repository: https://github.com/eza-community/eza
Blast Radius: 1.0

Affected Packages