CVE-2024-25817
eza Potential Heap Overflow Vulnerability for AArch64
Impact
### Summary In `eza`, there exists a potential heap overflow vulnerability, first seen when using Ubuntu for Raspberry Pi series system, on `ubuntu-raspi` kernel, relating to the `.git` directory. ### Details The vulnerability seems to be triggered by the `.git` directory in some projects. This issue may be related to specific files, and the directory structure also plays a role in triggering the vulnerability. Files/folders that may be involved in triggering the vulnerability include `.git/HEAD`, `.git/refs`, and `.git/objects`. As @polly pointed out to me, this is likely caused by [GHSA-j2v7-4f6v-gpg8](https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8), which we do seem to use currently. ### PoC For more information check @CuB3y0nd's blogpost [blog](https://www.cubeyond.net/blog/eza-cve-report). ### Impact Arbitrary code execution.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | eza | < 0.18.2 | 0.18.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eza.Rock | Eza | before 0.18.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-3qx3-6hxr-j2ch
- https://www.cubeyond.net/blog/my-cves/eza-cve-report
- https://github.com/eza-community/eza/security/advisories/GHSA-3qx3-6hxr-j2ch
- https://github.com/eza-community/eza/commit/47c9b90368c49117ba42760bd58acafa3362cbd4