¡¾Îó²îͨ¸æ¡¿Git×ÓÄ£¿£¿£¿£¿é·¾¶»Ø³µ·ûµ¼ÖÂÔ¶³Ì´úÂëÖ´ÐÐÎó²î (CVE-2025-48384)

Ðû²¼Ê±¼ä 2025-07-09

Ò»¡¢Îó²î¸ÅÊö


Îó²îÃû³Æ

Git×ÓÄ£¿£¿£¿£¿é·¾¶»Ø³µ·ûµ¼ÖÂÔ¶³Ì´úÂëÖ´ÐÐÎó²î

CVE   ID

CVE-2025-48384

Îó²îÀàÐÍ

ÏÂÁîÖ´ÐÐ

·¢Ã÷ʱ¼ä

2025-07-09

Îó²îÆÀ·Ö

8.0

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

µÍ

ʹÓÃÄѶÈ

¸ß

Óû§½»»¥

ÐèÒª

PoC/EXP

ÒѹûÕæ

ÔÚҰʹÓÃ

δ·¢Ã÷


GitÊÇÒ»¸öÂþÑÜʽ°æ±¾¿ØÖÆϵͳ £¬£¬£¬ÓÃÓÚ¸ú×ÙÎļþת±ä²¢Ð­×÷¿ª·¢Èí¼þ¡£¡£¡£¡£¡£ÓÉLinus TorvaldsÓÚ2005Ä꽨Éè £¬£¬£¬GitÔÊÐí¶à¸ö¿ª·¢Õß²¢ÐÐÊÂÇé £¬£¬£¬ÖÎÀíÔ´´úÂëÀúÊ·¼Í¼¡£¡£¡£¡£¡£ËüÖ§³ÖÍâµØ²Ù×÷ £¬£¬£¬Óû§ÎÞÐèÅþÁ¬µ½ÖÐÑëЧÀÍÆ÷¼´¿É¾ÙÐа汾¿ØÖÆ¡£¡£¡£¡£¡£GitµÄ½¹µãÌصã°üÀ¨¸ßЧµÄ·ÖÖ§ÖÎÀí¡¢ºÏ²¢¹¦Ð§¡¢ÒÔ¼°Ö§³Ö´ó¹æÄ£ÏîÄ¿µÄÄÜÁ¦¡£¡£¡£¡£¡£Í¨¹ýÏÂÁîÐкÍͼÐνçÃ湤¾ß£¨ÈçGitHub Desktop£©¿ÉÒÔÓëGit¿ÍÕ»¾ÙÐн»»¥ £¬£¬£¬ÆÕ±éÓ¦ÓÃÓÚ¿ªÔ´ºÍ˽ÓÐÈí¼þÏîÄ¿ÖС£¡£¡£¡£¡£


2025Äê7ÔÂ8ÈÕ £¬£¬£¬¼øºÚµ£±£Íø¼¯ÍÅVSRC¼à²âµ½GitÖеÄÒ»¸öÔ¶³Ì´úÂëÖ´ÐÐÎó²î £¬£¬£¬Ó°ÏìÀàUnixƽ̨¡£¡£¡£¡£¡£¸ÃÎó²îÔ´ÓÚGitÉèÖÃÎļþ¶Ô»Ø³µ·û£¨CR£©µÄ´¦Öóͷ£²»µ±¡£¡£¡£¡£¡£ÔÚʹÓÃgit clone --recursiveÏÂÁîʱ £¬£¬£¬Git»á´Ó.gitmodulesÎļþ¶ÁÈ¡×ÓÄ£¿£¿£¿£¿é·¾¶²¢¼ì³öÏìÓ¦µÄ×ÓÄ£¿£¿£¿£¿é¡£¡£¡£¡£¡£È»¶ø £¬£¬£¬Èô×ÓÄ£¿£¿£¿£¿é·¾¶°üÀ¨Î²²¿»Ø³µ·û£¨^M£© £¬£¬£¬Git»á¹ýʧµØ´¦Öóͷ£¸Ã·¾¶ £¬£¬£¬µ¼Ö»سµ·ûɥʧ²¢½«Â·¾¶Ð´Èë.git/modules/foo/configÖÐ £¬£¬£¬½ø¶øʹ×ÓÄ£¿£¿£¿£¿é±»¼ì³öµ½¹ýʧ·¾¶¡£¡£¡£¡£¡£Èô±£´æ·ûºÅÁ´½ÓÖ¸Ïò¹ýʧ·¾¶ £¬£¬£¬²¢ÇÒ×ÓÄ£¿£¿£¿£¿é°üÀ¨¿ÉÖ´ÐеÄpost-checkout¹³×Ӿ籾 £¬£¬£¬¸Ã¾ç±¾¿ÉÄÜÔÚ¼ì³öʱÒâÍâÖ´ÐÐ £¬£¬£¬´Ó¶øµ¼ÖÂÔ¶³Ì´úÂëÖ´ÐУ¨RCE£©¡£¡£¡£¡£¡£´ËÎó²î¿É±»Ê¹ÓÃͨ¹ý¶ñÒâÐÞ¸Ä.gitmodulesÎļþ»ò×¢Èë»Ø³µ·ûÀ´¿ØÖÆ×ÓÄ£¿£¿£¿£¿é¼ì³öÀú³Ì¡£¡£¡£¡£¡£


¶þ¡¢Ó°Ïì¹æÄ£


Git <= 2.50.0


Èý¡¢Çå¾²²½·¥


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑÐû²¼ÐÞ¸´°æ±¾ £¬£¬£¬½¨ÒéÓû§Éý¼¶ÖÁÈçÏ°汾
Git >= 2.43.7
Git >= 2.44.4
Git >= 2.45.4
Git >= 2.46.4
Git >= 2.47.3
Git >= 2.48.2
Git >= 2.49.1
Git >= 2.50.1


ÏÂÔØÁ´½Ó£ºhttps://github.com/git/git/tags


3.2 ÔÝʱ²½·¥


ÔÝÎÞ¡£¡£¡£¡£¡£


3.3 ͨÓý¨Òé


?°´ÆÚ¸üÐÂϵͳ²¹¶¡ £¬£¬£¬ïÔ̭ϵͳÎó²î £¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£
?ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ £¬£¬£¬Ð޸ķÀ»ðǽսÂÔ £¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ £¬£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø £¬£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£¡£¡£
?ʹÓÃÆóÒµ¼¶Çå¾²²úÆ· £¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£
?ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí £¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖƺÍ×îСȨÏÞÔ­Ôò £¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£

?ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9
https://nvd.nist.gov/vuln/detail/CVE-2025-48384