CVE-2024-35197
gix refs and paths with reserved Windows device names access the devices
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances. If Windows is not used, or untrusted repositories are not cloned or otherwise used, then there is no impact. A minor degradation in availability may also be possible, such as with a very large file named `CON`, though the user could interrupt the application.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
| NVDNVD · Deferred | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
- EPSS (exploitation in 30 days)
- 0.45% · top 61% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- crates.iogitoxideGHSA-49jc-r788-3fc9 (opens in a new tab)
- crates.iogitoxide-coreGHSA-49jc-r788-3fc9 (opens in a new tab)
- crates.iogixGHSA-49jc-r788-3fc9 (opens in a new tab)
- crates.iogix-indexGHSA-49jc-r788-3fc9 (opens in a new tab)
- crates.iogix-refGHSA-49jc-r788-3fc9 (opens in a new tab)
- crates.iogix-worktreeGHSA-49jc-r788-3fc9 (opens in a new tab)
- crates.iogix-worktree-stateGHSA-49jc-r788-3fc9 (opens in a new tab)
References (1)
- https://github.com/Byron/gitoxide/security/advisories/GHSA-49jc-r788-3fc9 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-49jc-r788-3fc9 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-35197)Record last updated .