Cyber Resilience

CVE-2022-23521

Memory Safety in Git-Scm Git ≤ 2.30.6

High EPSSMemory Safety
Published
17 January 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.56 99th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2022-23521 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Git-Scm Git. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Git is affected by multiple integer overflow vulnerabilities (CWE-190) in its gitattributes parsing logic. These occur when processing a crafted .gitattributes file containing an extremely large number of path patterns, attributes per pattern, or oversized attribute names. The overflows can produce arbitrary heap reads and writes that may lead to remote code execution. The issue exists in Git’s handling of attributes defined via repository files and was corrected in the coordinated releases published on 2023-01-17, including backports to v2.30.7.

An attacker can supply a malicious .gitattributes file as part of commit history. Because Git does not enforce the 2 KB line-length limit when reading from the index, the overflows can be triggered during normal operations such as clone, checkout, or diff that parse attributes from the index or working tree. Successful exploitation requires no authentication or user interaction and yields full control over the affected process, corresponding to the CVSS 9.8 rating.

Official patches and the Git security advisory GHSA-c738-c5qq-xg89 state there are no workarounds and direct users to upgrade to a patched version. Downstream distributions such as Gentoo have issued corresponding advisories (GLSA-202312-15) that reiterate the same upgrade guidance.

EPSS for the CVE reached a peak of 0.1637 before receding to the current value of 0.0944, indicating measurable post-disclosure exploitation interest that has since declined.

EU & UK References

Vulnerability Data

Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that…

more

should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Malicious .gitattributes file supplied via commit history triggers integer overflows during clone/checkout/diff, enabling remote code execution without authentication.
T1203 Exploitation for Client Execution Executionconfidence: HIGH
Exploitation occurs automatically when Git parses the crafted attributes file during normal client-side operations.
T1055 Process Injection Stealthconfidence: MEDIUM
Arbitrary heap reads/writes from the overflow can be leveraged for process injection to achieve code execution.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2017-1000117Same product: Git-Scm Git
CVE-2023-22490Same product: Git-Scm Git
CVE-2023-23946Same product: Git-Scm Git
CVE-2024-32020Same product: Git-Scm Git
CVE-2023-29007Same product: Git-Scm Git
CVE-2023-25652Same product: Git-Scm Git
CVE-2024-32021Same product: Git-Scm Git
CVE-2024-32004Same product: Git-Scm Git
CVE-2024-32465Same product: Git-Scm Git
CVE-2025-48384Same product: Git-Scm Git

Affected Assets

git-scm
git
2.39.0 · ≤ 2.30.6 · 2.31.0 — 2.31.5 · 2.32.0 — 2.32.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-2 Flaw Remediation
  • SI-16 Memory Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V5.2.6

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces validation of .gitattributes input size, pattern count, and attribute length to block the integer overflows that produce heap R/W and RCE.

prevent

Requires timely application of the vendor patches (v2.30.7+) that eliminate the overflow conditions in gitattributes parsing.

prevent

Provides memory-protection mechanisms that can block or contain the arbitrary heap reads/writes resulting from a successful overflow.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require use of safe arithmetic, bounds checks, and testing that prevent integer overflows.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect integer overflows before release.

prevents

Secure SDLC mandates input validation and arithmetic checks that prevent integer overflows.

degrades

Application security requirements include bounds checking and safe arithmetic to avoid overflow conditions.

degrades

Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.

prevents

Secure coding standards explicitly forbid unsafe integer operations and mandate overflow-safe constructs.

References