Refs and paths with reserved Windows device names access the devices

{
  "id": "99d31b4a4de1296e99475c1d4ec57b8a4a4c79bd8141cdf65fea1da33708275f",
  "url": "https://osv.dev/vulnerability/RUSTSEC-2024-0353",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Refs and paths with reserved Windows device names access the devices",
    "summary": "### Summary On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances. ### Details It is possible to create a Git repository that contains references or filenames that Windows treats as legacy DOS-style aliases for system devices. When such a repository is cloned: - In references, `gix-ref` does not include a check for such names before attempting to access them on disk, which reads from the devices, though the ability to exfiltrate data appears limited. - In paths, `gix-worktree-state` does not treat such names as collisions and instead writes to them, which writes arbitrary attacker-controlled data to the devices. Some such device names refer to devices that are often absent or inaccessible. But a few are guaranteed to be available, allowing some attacks to be carried out with low complexity. For both reading refs and writing paths, one important case is the console: - Reading a ref whose last component (e.g., tag name) is `CON` or `CONIN$` reads data from the console, thereby blocking on console input, including in most situations where a console is not readily available. This may facilitate denial of service attacks. - Checking out a file nam",
    "evidence": "osv:RUSTSEC-2024-0353",
    "products": [
      {
        "name": {
          "value": "gix-worktree",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.34.0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "RUSTSEC-2024-0353",
      "aliases": [
        "CVE-2024-35197",
        "GHSA-49jc-r788-3fc9",
        "RUSTSEC-2024-0351",
        "RUSTSEC-2024-0352",
        "RUSTSEC-2024-0353"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0.0.0-0"
                },
                {
                  "fixed": "0.34.0"
                }
              ]
            }
          ],
          "package": {
            "name": "gix-worktree",
            "purl": "pkg:cargo/gix-worktree",
            "ecosystem": "crates.io"
          },
          "database_specific": {
            "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "source": "https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2024-0353.json",
            "categories": [],
            "informational": null
          },
          "ecosystem_specific": {
            "affects": {
              "os": [
                "windows"
              ],
              "arch": [],
              "functions": []
            },
            "affected_functions": null
          }
        }
      ],
      "modified": "2026-10-12T18:00:02.665832617Z",
      "provider": "osv",
      "references": [
        "https://crates.io/crates/gix-worktree",
        "https://rustsec.org/advisories/RUSTSEC-2024-0353.html",
        "https://github.com/GitoxideLabs/gitoxide/commit/79dce79c62f6072aa2653780d590dc3993dfa401",
        "https://github.com/advisories/GHSA-49jc-r788-3fc9",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-35197"
      ],
      "provider_metadata": {
        "license": "CC0-1.0"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-35197",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 306319,
  "published_at": "2024-05-22T12:00:00+00:00"
}