CVE-2018-1000156: Input Validation
GNU patch does not properly sanitize patch files allowing for malicious patches to pass arbitrary shell commands to ed. An attacker could exploit this by tricking a user into applying malicious patches with the patch command.
Other sources
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/patchto a version that resolves this vulnerability.Fixed in 2.7.6-7Fixed in 2.8-2 - Upgrade
Upgrade
GNU Patchto a version that resolves this vulnerability.Fixed in 2.7.6 - Compensating control
Prevent untrusted users from providing or influencing patch files or patch command invocations; ensure only trusted patch files are processed by the patch utility.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1000156?
CVE-2018-1000156 is considered a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2018-1000156?
To fix CVE-2018-1000156, update GNU Patch to version 2.7.6-7 or later.
Which versions of GNU Patch are affected by CVE-2018-1000156?
GNU Patch version 2.7.6 is affected by CVE-2018-1000156.
How can an attacker exploit CVE-2018-1000156?
An attacker can exploit CVE-2018-1000156 by tricking a user into applying a malicious patch file.
What systems are vulnerable to CVE-2018-1000156?
Systems using GNU Patch version 2.7.6, including Debian and various versions of Ubuntu and Red Hat Enterprise Linux, are vulnerable to CVE-2018-1000156.