¡¾Îó²îͨ¸æ¡¿Git×ÓÄ£¿é·¾¶»Ø³µ·ûµ¼ÖÂÔ¶³Ì´úÂëÖ´ÐÐÎó²î (CVE-2025-48384)

Ðû²¼Ê±¼ä 2025-07-09

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Git×ÓÄ£¿é·¾¶»Ø³µ·ûµ¼ÖÂÔ¶³Ì´úÂëÖ´ÐÐÎó²î

CVE   ID

CVE-2025-48384

Îó²îÀàÐÍ

ÏÂÁîÖ´ÐÐ

·¢Ã÷ʱ¼ä

2025-07-09

Îó²îÆÀ·Ö

8.0

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

µÍ

ʹÓÃÄѶÈ

¸ß

Óû§½»»¥

ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


GitÊÇÒ»¸öÂþÑÜʽ°æ±¾¿ØÖÆϵͳ£¬ÓÃÓÚ¸ú×ÙÎļþת±ä²¢Ð­×÷¿ª·¢Èí¼þ¡£ÓÉLinus TorvaldsÓÚ2005Ä꽨É裬GitÔÊÐí¶à¸ö¿ª·¢Õß²¢ÐÐÊÂÇ飬ÖÎÀíÔ´´úÂëÀúÊ·¼Í¼¡£ËüÖ§³ÖÍâµØ²Ù×÷£¬Óû§ÎÞÐèÅþÁ¬µ½ÖÐÑë·þÎñÆ÷¼´¿É¾ÙÐа汾¿ØÖÆ¡£GitµÄ½¹µãÌصã°üÀ¨¸ßЧµÄ·ÖÖ§ÖÎÀí¡¢ºÏ²¢¹¦Ð§¡¢ÒÔ¼°Ö§³Ö´ó¹æÄ£ÏîÄ¿µÄÄÜÁ¦¡£Í¨¹ýÏÂÁîÐкÍͼÐνçÃ湤¾ß£¨ÈçGitHub Desktop£©¿ÉÒÔÓëGit¿ÍÕ»¾ÙÐн»»¥£¬ÆÕ±éÓ¦ÓÃÓÚ¿ªÔ´ºÍ˽ÓÐÈí¼þÏîÄ¿ÖС£


2025Äê7ÔÂ8ÈÕ£¬×ðÁú¿­Ê±¼¯ÍÅVSRC¼à²âµ½GitÖеÄÒ»¸öÔ¶³Ì´úÂëÖ´ÐÐÎó²î£¬Ó°ÏìÀàUnixƽ̨¡£¸ÃÎó²îÔ´ÓÚGitÉèÖÃÎļþ¶Ô»Ø³µ·û£¨CR£©µÄ´¦Öóͷ£²»µ±¡£ÔÚʹÓÃgit clone --recursiveÏÂÁîʱ£¬Git»á´Ó.gitmodulesÎļþ¶ÁÈ¡×ÓÄ£¿é·¾¶²¢¼ì³öÏìÓ¦µÄ×ÓÄ£¿é¡£È»¶ø£¬Èô×ÓÄ£¿é·¾¶°üÀ¨Î²²¿»Ø³µ·û£¨^M£©£¬Git»á¹ýʧµØ´¦Öóͷ£¸Ã·¾¶£¬µ¼Ö»سµ·ûɥʧ²¢½«Â·¾¶Ð´Èë.git/modules/foo/configÖУ¬½ø¶øʹ×ÓÄ£¿é±»¼ì³öµ½¹ýʧ·¾¶¡£Èô±£´æ·ûºÅÁ´½ÓÖ¸Ïò¹ýʧ·¾¶£¬²¢ÇÒ×ÓÄ£¿é°üÀ¨¿ÉÖ´ÐеÄpost-checkout¹³×Ӿ籾£¬¸Ã¾ç±¾¿ÉÄÜÔÚ¼ì³öʱÒâÍâÖ´ÐУ¬´Ó¶øµ¼ÖÂÔ¶³Ì´úÂëÖ´ÐУ¨RCE£©¡£´ËÎó²î¿É±»Ê¹ÓÃͨ¹ý¶ñÒâÐÞ¸Ä.gitmodulesÎļþ»ò×¢Èë»Ø³µ·ûÀ´¿ØÖÆ×ÓÄ£¿é¼ì³öÀú³Ì¡£


¶þ¡¢Ó°Ïì¹æÄ£


Git <= 2.50.0


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´°æ±¾£¬½¨ÒéÓû§Éý¼¶ÖÁÈçÏ°汾
Git >= 2.43.7
Git >= 2.44.4
Git >= 2.45.4
Git >= 2.46.4
Git >= 2.47.3
Git >= 2.48.2
Git >= 2.49.1
Git >= 2.50.1


ÏÂÔØÁ´½Ó£ºhttps://github.com/git/git/tags


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£


3.3 ͨÓý¨Òé


?°´ÆÚ¸üÐÂϵͳ²¹¶¡£¬ïÔ̭ϵͳÎó²î£¬ÌáÉý·þÎñÆ÷µÄÇå¾²ÐÔ¡£
?ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬Ð޸ķÀ»ðǽսÂÔ£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻò·þÎñ£¬ïÔÌ­½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬ïÔÌ­¹¥»÷Ãæ¡£
?ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£
?ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£

?ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£


3.4 ²Î¿¼Á´½Ó


https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9
https://nvd.nist.gov/vuln/detail/CVE-2025-48384