REDHAT-BUG-2558775: Medium severity GNU patch vulnerability
A flaw was found in GNU patch. The reversal fallback in intuitdifftype() in src/pch.c selects a filename from the patch headers without applying the nameisvalid() check that normally rejects absolute paths. A crafted unified diff that appears to delete a nonexistent file, with an absolute filename in both headers and an epoch timestamp for the new file, can trigger automatic reversal when applied with patch -p0 -t. The unvalidated absolute filename reaches the filesystem operations, allowing attacker-controlled file creation outside the working directory with the permissions of the account running patch. Exploitation requires a user or workflow to apply the crafted patch; it does not bypass operating-system filesystem permissions.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users and automated workflows that apply attacker-controlled or untrusted unified diffs with GNU patch are exposed when they use the affected invocation conditions. The resulting file operations run with the permissions of the account executing patch.
What conditions are required for exploitation?
An attacker needs to provide a crafted unified diff that appears to delete a nonexistent file, uses an absolute filename in both headers, and gives the new file an epoch timestamp. The patch must be applied with patch -p0 -t so that automatic reversal is triggered.
Does this allow an attacker to bypass filesystem permissions?
No. The flaw can cause file creation outside the intended working directory, but it does not bypass operating-system filesystem permissions; creation is limited to locations writable by the account running patch.
What can be done before a fix is available?
Do not apply untrusted patches with patch -p0 -t, particularly in automated workflows. Review patch headers for absolute filenames and avoid configurations that permit automatic reversal of attacker-supplied diffs.