🛡️ CVE-2022-24765 — debian-linux
Description
Uncontrolled search for the Git directory in Git for Windows
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder C:\.git, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set GIT_PS1_SHOWDIRTYSTATE are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in C:\.git\config. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder .git on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend GIT_CEILING_DIRECTORIES to cover the _parent_ directory of the user profile, e.g. C:\Users if the user profile is located in C:\Users\my-user-name.
How this vulnerability can be exploited
This issue can be reached with local access to the system, attack complexity is high, an attacker needs low-level privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability none.
CVSS metrics in full
The score comes from this vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
- Attack vector: Local — a local account, shell or session on the host is needed.
- Attack complexity: High — the attacker first has to win a race, learn a secret or otherwise prepare the target.
- Privileges required: Low — an ordinary user account is enough.
- User interaction: Required — someone has to click, open or visit something.
- Scope: Unchanged — the damage stays inside the vulnerable component.
- Confidentiality impact: High — total loss, or loss the attacker controls.
- Integrity impact: High — total loss, or loss the attacker controls.
- Availability impact: None.
Weakness class
CVE-2022-24765 is classified as CWE-427: Uncontrolled Search Path Element. A writable directory appears in a search path, so a planted file can be loaded in place of the intended one.
Affected software
CVE-2022-24765 is recorded against 4 packages.
- debian-linux
- fedora
- git
- xcode (fixed in 13.4)
Timeline and source
Published on 12 April 2022 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.
References
seclists.org
www.openwall.com
git-scm.com
git-scm.com
github.com
lists.debian.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
security.gentoo.org
support.apple.com
seclists.org
www.openwall.com
git-scm.com
git-scm.com
github.com
lists.debian.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
lists.fedoraproject.org
security.gentoo.org
support.apple.com
Other advisories for this package
debian-linux has other advisories on record. If you are patching this one, these are worth checking on the same host:
- CVE-2026-12996 (8.1 High, published 30 Jul 2026)
- CVE-2026-14355 (5.6 Medium, published 3 Jul 2026)
- CVE-2026-56968 (3.7 Low, published 23 Jun 2026)
- CVE-2026-49975 (7.5 High, published 8 Jun 2026)
- CVE-2026-9256 (8.1 High, published 22 May 2026)
- CVE-2026-46333 (7.1 High, published 15 May 2026)
- CVE-2026-31431 (7.8 High, published 22 Apr 2026)
- CVE-2026-41082 (7.3 High, published 16 Apr 2026)
Same weakness in other software
These advisories are the same class of weakness (CWE-427: Uncontrolled Search Path Element) in other software:
- CVE-2026-13133 (published 10 Aug 2026)
- CVE-2026-9169 (8.8 High, published 7 Aug 2026)
- CVE-2026-66344 (6.7 Medium, published 5 Aug 2026)
- CVE-2026-18657 (7.8 High, published 4 Aug 2026)
- CVE-2026-18656 (7.8 High, published 4 Aug 2026)
- CVE-2026-18718 (7.0 High, published 3 Aug 2026)
- CVE-2026-9593 (6.7 Medium, published 3 Aug 2026)
- CVE-2026-8164 (7.3 High, published 28 Jul 2026)
CVE-2022-24765 on other distributions
Each distribution ships its own build and its own fixed version. Pick the one you run:
Details
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| debian-linux | — | — |
| fedora | — | — |
| git | — | — |
| xcode | — | 13.4 |
References
Similar Threats
- Critical CVE-2022-0194
- High CVE-2022-0367
- Medium CVE-2022-0171
- High CVE-2022-0135
- High CVE-2022-0204
Site Security Check
Is debian-linux part of your stack?
CVE-2022-24765 is rated CVSS 8.0 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
