CVE-2024-35197
About
gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances. If Windows is not used, or untrusted repositories are not cloned or otherwise used, then there is no impact. A minor degradation in availability may also be possible, such as with a very large file named `CON`, though the user could interrupt the application.
Rainforest analyst review
gitoxide, a Rust implementation of Git, mishandles Windows legacy device names: fetching refs that collide with names like CON reads from the actual devices, and checking out matching paths writes to them. A hostile repository can therefore make a clone hang indefinitely or emit output that looks like it came from the application, and in narrow cases cause other mischief.
The important thing is how many conditions have to line up. It only affects Windows, and only when cloning or otherwise handling an untrusted repository; on other platforms, or with trusted repos, there's simply no impact. That stacks a specific operating system, a user action, and attacker-controlled input into the exploitation path, which is why this is a moderate availability-and-spoofing issue rather than a severe one.
We treat this as a scoped, conditional concern and rank it accordingly. The relevant question is whether any Windows-based automation of ours clones untrusted repositories through gitoxide — CI runners and ingestion pipelines are the obvious places. Where that combination exists, updating the library is worthwhile; where our gitoxide usage is Linux-based or only touches trusted sources, this drops well down the queue.
References
Related CVEs
No related CVEs.
Frequently asked questions
What is CVE-2024-35197?
gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices.
How severe is CVE-2024-35197?
CVE-2024-35197 carries a CVSS 3.1 base score of 5.4, rated medium. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 58 out of 100, in the elevated band.
How is CVE-2024-35197 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L): attack vector Network, attack complexity Low, privileges required None, user interaction Required. Impact on confidentiality None, integrity Low and availability Low.
How do I fix CVE-2024-35197?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.