CVE-2022-23521High

Microsoft security update for CVE-2022-23521 — Microsoft Visual Studio

Published
February 14, 2023
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2022-23521 →

📋 Microsoft's advisory

EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23521. This page also shows what EchelonGraph holds for CVE-2022-23521, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.

🎯 Affected products5

  • Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
  • Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
  • Microsoft Visual Studio 2022 version 17.0
  • Microsoft Visual Studio 2022 version 17.2
  • Microsoft Visual Studio 2022 version 17.4

✅ Updates Microsoft lists: 5 updates

5 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.

KB articleUpdateFixed build
—Security Update15.9.52
—Security Update17.2.13
—Security Update16.11.24
—Security Update17.0.19
—Security Update17.4.5

🧭 EchelonGraph on CVE-2022-23521

EchelonGraph score
9.8 CRITICAL
CISA KEV
Not listed
Fix status
A fix is available — apply it.

Description from the CVE record (CVE.org), as published by its numbering authority

Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue.

Published by GitHub, Inc., the CVE Numbering Authority that assigned CVE-2022-23521, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).

🔗 References (11)