15 ms·

Patch runs ed, and ed can run anything

490 points by akerl_ 9y ago

Blackthorn 9y ago
Eep. Seems like patch should be running red, not ed! Amazing how an ancient vuln can still be found hidden in plain sight.
- oblio 9y ago
  Does anyone know if the GNU tools, the coreutils, have been through security audits and fuzzing? They’re the most used tools on the planet, I’d say, and relying on the 90’s “many eyes make all bugs shallow” doesn’t seem to cut it anymore...
  - Ajedi32 9y ago
    Google has an ongoing project for fuzzing popular open source software: https://testing.googleblog.com/2016/12/announcing-oss-fuzz-continuous-fuzzing.html https://testing.googleblog.com/2016/12/announcing-oss-fuzz-c... Looks like at least _some_ GNU tools are covered: https://github.com/google/oss-fuzz/tree/master/projects/gnutls https://github.com/google/oss-fuzz/tree/master/projects/gnut...
  - jwilk 9y ago
    For the avoidance of doubt, GNU patch is not part of coreutils.
  - teamhappy 9y ago
    Audits and fuzzing don't really make sense if it's a documented feature. Also the many eyeballs principle seems to hold given that the Debian folks found the bug. Having said that, a lot of the core command line tools (not just the GNU coreutils) that are run against untrusted input could certainly be improved. I'd prefer the OpenBSD method though - if it can't exec then I don't need to worry about the bugs the auditor/fuzzer didn't find.
    - oblio 9y ago
      The earliest GNU Patch I could find was 2.5.4, from 1999: https://ftp.gnu.org/pub/gnu/patch/ https://ftp.gnu.org/pub/gnu/patch/ And that’s 2.5.4, 1.0.0 could have been released in 1985 for all we know. I guess we have many eyeballs, yet not enough still :)
  - mjw1007 9y ago
    The «Fuzz Revisited: A Re-examination of the Reliability of UNIX Utilities and Services» paper in 1995 reported on exactly that. It made a bit of a splash at the time because the GNU command-line tools did noticeably better than the commercial ones. https://minds.wisconsin.edu/bitstream/handle/1793/59964/TR1268.pdf https://minds.wisconsin.edu/bitstream/handle/1793/59964/TR12...
    - oblio 9y ago
      Could be, but that was 23 years ago. That report would now be graduating from college :)
  - pixelbeat__ 9y ago
    I'm the GNU coreutils maintainer and have fuzzed them extensively. For example a recent bad bug in TZ handling was found using AFL and fixed by: http://git.sv.gnu.org/gitweb/?p=gnulib.git;a=commitdiff;h=94e01571 http://git.sv.gnu.org/gitweb/?p=gnulib.git;a=commitdiff;h=94... We put a lot of effort into the test suite which makes it easy for others to test various experimental security checkers. This has been detailed in the "third party testing" section at: http://www.pixelbeat.org/docs/coreutils-testing.html http://www.pixelbeat.org/docs/coreutils-testing.html
    - oblio 9y ago
      My bad, another commenter pointed out that GNU Patch is not part of coreutils. The GNU umbrella is quite wide these days...
    - DyslexicAtheist 9y ago
      wow pretty awesome to see such a QA pipeline in Open Source projects. I'm used to this in expensive R&D pipelines in the Telco space[0]. Is there a reason you're not using oss-fuzz[1]? I recently did a lot of work using AFL-fast[2] (poking mostly Perl & Lua and crappy IoT products). My experience is that AFL-fast yielded far better results (in a fraction of the time) when compared to AFL. [0] http://www.syssec-project.eu/m/page-media/3/johansson_tfuzz_icst14.pdf http://www.syssec-project.eu/m/page-media/3/johansson_tfuzz_... [1] https://github.com/google/oss-fuzz https://github.com/google/oss-fuzz [2] https://github.com/mboehme/aflfast https://github.com/mboehme/aflfast
      - pixelbeat__ 9y ago
        aflfast is mentioned in my second link and was the most used fuzzing implementation to find bugs in coreutils. We've had a quick look at using oss-fuzz, which will need a bit of work since it's more suited to libraries rather than standalone utils.
- emaste 9y ago
  FreeBSD's patch runs red, a change we picked up from DragonFly BSD. That said OpenBSD's change to internally handle ed-style diffs is the best approach and I expect FreeBSD will migrate to that.
Spivak 9y ago
I will admit that people consider it a little surprising and non-hackers will be very loudly booed if they rely on this behavior but ed finds it way into lots of utilities like this. It's a remnant of a bygone era where people wanted their tools to have this kind of power. But the author is absolutely right, nowadays we should prefer red. Still a small amount of shame if you're applying untrusted patches.
- kragen 9y ago
  I don't think it's so much that people wanted patch to be able to run arbitrary code, but rather that writing your tools to be very flexible allows you to get the functionality you need with very little code. The first version of ctags was written as a shell script that invoked ed to do the heavy lifting, for example. It was a small fraction of the rewrite of ctags in C in later Unixes. So that's how you end up with m4 being Turing-complete, being able to put shell commands in anything, that sort of thing.
- zokier 9y ago
  The early computing era (I'd say until early '90s) was definitely had something special in the way so much relied on trust, both trusting the user and trusting the wider community. Today everything is so locked down, paranoid and anxiety inducing that computing has become increasingly stressful and unfun. I'm also reminded by a RMS writing (I think it was letter of some sort) campaigning that denying computer lab users root access was oppressive. Bit sad that I can't actually find it now. And of course the classic (if misused like I'm doing here) Franklin quote "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
  - makapuf 9y ago
    I think you're thinking of this https://unix.stackexchange.com/questions/4460/why-is-debian-not-creating-the-wheel-group-by-default https://unix.stackexchange.com/questions/4460/why-is-debian-... (see last answser). And yes I see the irony of going through stackoverflow for this.
gtrubetskoy 9y ago
Does this mean a "git pull" is vulnerable to this, or does git not rely on patch?
- Jasper_ 9y ago
  git's delta pack format which used on the wire is not based on patch. This would only affect "git patch" and derivatives like "git am".
  - eridius 9y ago
    Does `git apply` actually farm out to /usr/bin/patch? I kind of assumed it reimplemented the patching itself.
    - LukeShu 9y ago
      You're correct, git has its own patch implementation (plus, it's a bit stricter than the patch program, because it doesn't have to deal with various patch formats--only "unified" patches).
- gh02t 9y ago
  I believe git uses its own implementation for applying deltas sucked down by `git pull` https://github.com/git/git/blob/master/patch-delta.c There's also `git apply` that applies user supplied patchfiles but if I'm reading this correctly it also uses an internal implementation: https://github.com/git/git/blob/master/apply.c
gregoriol 9y ago
Does this mean that it would be dangerous to try to patch patch?
secure 9y ago
I don’t have ed installed (not a conscious decision), which prevents this from working: % patch<evil.patch sh: 1: ed: not found patch: ed FAILED patch works just fine for me, though, so ed is not required.
- cbr 9y ago
  What distribution? (I don't think I've ever used a system that didn't have ed installed by default.)
  - jwilk 9y ago
    Debian doesn't install ed by default, although it did in the past: https://bugs.debian.org/416585 https://bugs.debian.org/416585
  - checkyoursudo 9y ago
    My install of Gentoo Linux doesn't have ed. It is available in the packages, of course.
  - sothym 9y ago
    Arch Linux doesn't contain ed in their base package group.
  - jethro_tell 9y ago
    my arch/ubuntu/debian/rh hosts don't have it pre installed. It's installed by default in an aLinux instance though.
  - zaarn 9y ago
    Arch and Debian and Alpine Linux, to my knowledge. Which is sad because technically POSIX wants ed installed so purely technically, those distros aren't fully POSIX compliant.
- ben_bai 9y ago
  Patch applies files created with diff. Diff has 4 different output formats. One of those formats is basically a batch script with ed instructions. For patch to work correctly you have to allow executing ed commands (internally or by spawning ed) but for security reasons you better not let ed execute yet another program.
eridius 9y ago
Why does patch call ed? What did anyone ever actually use this for?
- schoen 9y ago
  Edit: I'm replacing my somewhat vague reply with a more correct answer: https://en.wikipedia.org/wiki/Diff_utility#Edit_script https://en.wikipedia.org/wiki/Diff_utility#Edit_script
- LukeShu 9y ago
  The `patch` program is expected to be able to apply any patchfile syntaxes created by `diff`. Once upon a time, the default behavior of diff was to spit out an `ed` script (nowadays, it's behind the `-e` flag). So, to apply that syntax of patchfile, it invokes `ed`.
- zokier 9y ago
  Unix principle of small tools chained together.
jimrandomh 9y ago
This is bad and should be fixed, but there are fairly few circumstances where it actually creates a new vulnerability. The majority of uses of patch are applied to source code by someone who's going to end up running that code anyways, so applying patches you haven't read closely from sources you don't trust is already unsafe.
- simlevesque 9y ago
  You could build the binary on your machine and run it inside a VM.
  - zitterbewegung 9y ago
    To be honest qubes seems to become a better and better idea to run all of the time.
  - petters 9y ago
    The patch could also modify the Makefile (or similar) to run arbitrary commands when the build is started.
- archgoon 9y ago
  The main place where this would be an issue would be if you have a server that is not going to build or run code, but applies patches to source and outputs the result. So a cr review website could be affected.
- tzs 9y ago
  > The majority of uses of patch are applied to source code by someone who's going to end up running that code anyways, so applying patches you haven't read closely from sources you don't trust is already unsafe. I think you are overlooking a case that I suspect is common: applying a patch without reading the patch source and then using your source code control system to review what the patch did. That lets you review that patch using whatever tools you normally use for reviewing code changes, which are often much nicer than reading a raw ed script.
yiyus 9y ago
This is, of course, a vulnerability. But let's not get too crazy. Once you are applying a patch, either you trust the patch or not. If you blindly apply patches, you will be in risk as soon as you run or try to compile the patched command. This attack is just a bit faster because it happens as soon as you apply the patch.
- schoen 9y ago
  Suppose you're applying patches to something other than software?
- 0x0 9y ago
  What if you're trying to apply a patch to a .txt document?
- mrob 9y ago
  Patch isn't only used for source code. I wouldn't have expected any risk of malicious code execution if I was patching documentation.
  - jwilk 9y ago
    Even for source, you may want to review the patch after applying it. For example, dpkg-source applies patches when you unpack source package. I don't think anybody expects code execution when unpacking stuff, even when this stuff is untrusted.
zitterbewegung 9y ago
This hole needs a fancy name. Patchowned? Pwneded ?
- gruez 9y ago
  PatchEd
- paulie_a 9y ago
  No, just no. Naming vulns is a theme that needs to go away
  - sigjuice 9y ago
    Agreed. Every mundane bug or misfeature doesn't need its own website or 20-page analysis. Fix things and move on to the next thing that needs fixing. There is an endless supply of broken things.
    - paulie_a 9y ago
      To be fair I can appreciate the technical analysis of a security issue. The marketing is useless and just plain stupid
  - flukus 9y ago
    I disagree, it's the only way to make the public aware of the issue and got the corporate hierarchy to expedite OS patching. Not that it's necessary in this case.
- rachelbythebay 9y ago
  I was hoping "bangpatch" (see URL). It's descriptive, and it's also a sly reference to the old-school days of UUCP.
- gaius 9y ago
  The Patch Snatch Batch
deleted 9y ago
[deleted]
volkadav 9y ago
similarly, i recall once being denied root on a host while trying to help out with something and then asking if i could at least have sudo less to look at things... which was granted. >:D (then i fixed the problem)
- jacquesm 9y ago
  Always nice to know more about the system than those nominally in charge of the system.
aplorbust 9y ago
"patch will attempt to determine the type of the diff listing, unless over-ruled by a -c, -e, -n, or -u option.Context diffs (old-style, new- style, and unified) and normal diffs are applied directly by the patch program itself, whereas ed diffs are simply fed to the ed(1) editor via a pipe." According to this, context diffs are not sent to ed. Is the author suggesting that patch can be fooled to interpret a context diff as an ed diff? Theres a file called pch.c with an excessive amount of parsing and "intuit" functions like intuit_diff_type(). patch has anthromorphised progress and error messages and tries to "guess". However I am only a dumb end user. I should not question what I do not understand. Its all safe I'm sure.
gbrown_ 9y ago
OpenBSD's patch handles ed style diffs internally now and also it is not permitted to execute other programs thanks to pledge. https://marc.info/?l=openbsd-cvs&m=144498099601083&w=2 https://marc.info/?l=openbsd-cvs&m=144498099601083&w=2
tantalor 9y ago
So patch can read email? https://en.wikipedia.org/wiki/Zawinski%27s_Law https://en.wikipedia.org/wiki/Zawinski%27s_Law
- dfsegoat 9y ago
  Off topic, and forgive my naivety & ignorance, but I really do not understand the highly specific nature of this Principle / Law, as it is on wiki: "Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can." ... was Mail just the example at the time? and this is basically just the a generic reference to feature/scope creep?... I just don't get the highly specific inclusion of "Reading mail" as something that all programs expand towards.
  - khedoros1 9y ago
    Synecdoche. Mail stands in for the general class of popular features.
  - jwilk 9y ago
    It's a joke about feature creep. Of course, most programs don't and shouldn't read mail. The choice of this particular feature was not accidental. JWZ was a developer of Netscape Mail: https://www.jwz.org/hacks/ https://www.jwz.org/hacks/
    - ryan-c 9y ago
      Copy/paste the link, do not click.
      - kstrauser 9y ago
        Why?
        ReverseCold 9y ago
        Try it and you'll see why. It's not bad.
jwilk 9y ago
The beep bug on HN: https://news.ycombinator.com/item?id=16753013 https://news.ycombinator.com/item?id=16753013
vilhelm_s 9y ago
The whole (satirical) website https://holeybeep.ninja/ https://holeybeep.ninja/ is really great.
HIPisTheAnswer 9y ago
Torvalds argument against microkernel: 'But, performance!'. Result: QubesOS ...
seanhunter 9y ago
Patch knows that ed is a fine choice. Ed is generous enough to flag errors, yet prudent enough not to overwhelm the novice with verbosity. In case anyone has not been exposed to the reference, it's perhaps invoking the famous `ed, man !man ed` page. https://www.gnu.org/fun/jokes/ed-msg.html https://www.gnu.org/fun/jokes/ed-msg.html
- rachelbythebay 9y ago
  Crap! I knew I forgot something. I forgot to reference "eat flaming death". Oh well, good catch!
  - orionblastar 9y ago
    We used that phrase in some Tradewar games during the BBS Era.
- knodi123 9y ago
  geez, towards the end that starts reading like my bottle of Dr Bronner's Soap
teeray 9y ago
So how long will it be before we have a Monero miner implementation in ed?
magwa101 9y ago
Real programmers use ed.
- sigjuice 9y ago
  Disagree :) $ cat >a.out EDIT: maybe not https://xkcd.com/378/ https://xkcd.com/378/
wodenokoto 9y ago
So, who is this Rachel, and why has her blog suddenly exploded on HN? Both old and new post have been filling the front page for about 2 weeks.
- deleted 9y ago
  [deleted]
- derp12345 9y ago
  I would also like to know the answer to this question. I enjoy the posts, generally, but I don't see why the sudden surge; there aren't even any ads (which is what I'd usually suspect)
  - Piskvorrr 9y ago
    Popularity breeds popularity: user sees link on HN, browses around on the site, finds something else interesting, also submits it to HN, etc.
- dang 9y ago
  The blog has been appearing on HN for many years. I assume she just started publishing more lately.
  - rachelbythebay 9y ago
    Yep. Getting out of a 'real job' released a whole bunch of cycles and there are a bunch of stories waiting to be told. I don't submit 'em ... I just write 'em.
- Piskvorrr 9y ago
  Try filtering around the discussions, she did mention having more time for writing recently.
DyslexicAtheist 9y ago
> This came up as part of the discussion on the "beep exploit" yesterday. I found it buried in the HN /new queue as a simple link to the Debian bug tracker. I was expecting this post to go through the roof and was rather surprised it gained zero traction, lol. Nobody using the GNU toolchain anymore on HN or it just got drowned out idk ... https://news.ycombinator.com/item?id=16766577 https://news.ycombinator.com/item?id=16766577
alex256148 9y ago
2nd Grader Brings Home Assignment Detailing Her White Privilege – ‘White Supremacy is All Whites’ http://acccurrent.info/other-information/2nd-grader-brings-home-assignment-detailing-her-white-privilege-white-supremacy-is-all-whites/ http://acccurrent.info/other-information/2nd-grader-brings-h...
brynet 9y ago
Text editors are shells, remember that if your program executes a text editor.
codedokode 9y ago
This is where unix philosophy fails. Patch should be editing files itself, not via an external program.
- cryptonector 9y ago
  This isn't the Unix philosophy at work. This is embedding a DSL. Microsot Office has the same exact problems, does it not? No Unix philosophy there.
cs702 9y ago
My reaction whenever I read things like the OP: https://blog.codinghorror.com/assets/images/codinghorror-app-icon.png?v=1162b121ab https://blog.codinghorror.com/assets/images/codinghorror-app...
hannob 9y ago
Here's the upstream bug report: https://savannah.gnu.org/bugs/index.php?53566 https://savannah.gnu.org/bugs/index.php?53566

490 points by akerl_ 9y ago

Eep. Seems like patch should be running red, not ed! Amazing how an ancient vuln can still be found hidden in plain sight.

oblio 9y ago
Does anyone know if the GNU tools, the coreutils, have been through security audits and fuzzing? They’re the most used tools on the planet, I’d say, and relying on the 90’s “many eyes make all bugs shallow” doesn’t seem to cut it anymore...
- Ajedi32 9y ago
  Google has an ongoing project for fuzzing popular open source software: https://testing.googleblog.com/2016/12/announcing-oss-fuzz-continuous-fuzzing.html https://testing.googleblog.com/2016/12/announcing-oss-fuzz-c... Looks like at least _some_ GNU tools are covered: https://github.com/google/oss-fuzz/tree/master/projects/gnutls https://github.com/google/oss-fuzz/tree/master/projects/gnut...
- jwilk 9y ago
  For the avoidance of doubt, GNU patch is not part of coreutils.
- teamhappy 9y ago
  Audits and fuzzing don't really make sense if it's a documented feature. Also the many eyeballs principle seems to hold given that the Debian folks found the bug. Having said that, a lot of the core command line tools (not just the GNU coreutils) that are run against untrusted input could certainly be improved. I'd prefer the OpenBSD method though - if it can't exec then I don't need to worry about the bugs the auditor/fuzzer didn't find.
  - oblio 9y ago
    The earliest GNU Patch I could find was 2.5.4, from 1999: https://ftp.gnu.org/pub/gnu/patch/ https://ftp.gnu.org/pub/gnu/patch/ And that’s 2.5.4, 1.0.0 could have been released in 1985 for all we know. I guess we have many eyeballs, yet not enough still :)
- mjw1007 9y ago
  The «Fuzz Revisited: A Re-examination of the Reliability of UNIX Utilities and Services» paper in 1995 reported on exactly that. It made a bit of a splash at the time because the GNU command-line tools did noticeably better than the commercial ones. https://minds.wisconsin.edu/bitstream/handle/1793/59964/TR1268.pdf https://minds.wisconsin.edu/bitstream/handle/1793/59964/TR12...
  - oblio 9y ago
    Could be, but that was 23 years ago. That report would now be graduating from college :)
- pixelbeat__ 9y ago
  I'm the GNU coreutils maintainer and have fuzzed them extensively. For example a recent bad bug in TZ handling was found using AFL and fixed by: http://git.sv.gnu.org/gitweb/?p=gnulib.git;a=commitdiff;h=94e01571 http://git.sv.gnu.org/gitweb/?p=gnulib.git;a=commitdiff;h=94... We put a lot of effort into the test suite which makes it easy for others to test various experimental security checkers. This has been detailed in the "third party testing" section at: http://www.pixelbeat.org/docs/coreutils-testing.html http://www.pixelbeat.org/docs/coreutils-testing.html
  - oblio 9y ago
    My bad, another commenter pointed out that GNU Patch is not part of coreutils. The GNU umbrella is quite wide these days...
  - DyslexicAtheist 9y ago
    wow pretty awesome to see such a QA pipeline in Open Source projects. I'm used to this in expensive R&D pipelines in the Telco space[0]. Is there a reason you're not using oss-fuzz[1]? I recently did a lot of work using AFL-fast[2] (poking mostly Perl & Lua and crappy IoT products). My experience is that AFL-fast yielded far better results (in a fraction of the time) when compared to AFL. [0] http://www.syssec-project.eu/m/page-media/3/johansson_tfuzz_icst14.pdf http://www.syssec-project.eu/m/page-media/3/johansson_tfuzz_... [1] https://github.com/google/oss-fuzz https://github.com/google/oss-fuzz [2] https://github.com/mboehme/aflfast https://github.com/mboehme/aflfast
    - pixelbeat__ 9y ago
      aflfast is mentioned in my second link and was the most used fuzzing implementation to find bugs in coreutils. We've had a quick look at using oss-fuzz, which will need a bit of work since it's more suited to libraries rather than standalone utils.
emaste 9y ago
FreeBSD's patch runs red, a change we picked up from DragonFly BSD. That said OpenBSD's change to internally handle ed-style diffs is the best approach and I expect FreeBSD will migrate to that.

Spivak 9y ago

I will admit that people consider it a little surprising and non-hackers will be very loudly booed if they rely on this behavior but ed finds it way into lots of utilities like this. It's a remnant of a bygone era where people wanted their tools to have this kind of power. But the author is absolutely right, nowadays we should prefer red. Still a small amount of shame if you're applying untrusted patches.

kragen 9y ago
I don't think it's so much that people wanted patch to be able to run arbitrary code, but rather that writing your tools to be very flexible allows you to get the functionality you need with very little code. The first version of ctags was written as a shell script that invoked ed to do the heavy lifting, for example. It was a small fraction of the rewrite of ctags in C in later Unixes. So that's how you end up with m4 being Turing-complete, being able to put shell commands in anything, that sort of thing.
zokier 9y ago
The early computing era (I'd say until early '90s) was definitely had something special in the way so much relied on trust, both trusting the user and trusting the wider community. Today everything is so locked down, paranoid and anxiety inducing that computing has become increasingly stressful and unfun. I'm also reminded by a RMS writing (I think it was letter of some sort) campaigning that denying computer lab users root access was oppressive. Bit sad that I can't actually find it now. And of course the classic (if misused like I'm doing here) Franklin quote "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
- makapuf 9y ago
  I think you're thinking of this https://unix.stackexchange.com/questions/4460/why-is-debian-not-creating-the-wheel-group-by-default https://unix.stackexchange.com/questions/4460/why-is-debian-... (see last answser). And yes I see the irony of going through stackoverflow for this.

gtrubetskoy 9y ago

Does this mean a "git pull" is vulnerable to this, or does git not rely on patch?

Jasper_ 9y ago
git's delta pack format which used on the wire is not based on patch. This would only affect "git patch" and derivatives like "git am".
- eridius 9y ago
  Does `git apply` actually farm out to /usr/bin/patch? I kind of assumed it reimplemented the patching itself.
  - LukeShu 9y ago
    You're correct, git has its own patch implementation (plus, it's a bit stricter than the patch program, because it doesn't have to deal with various patch formats--only "unified" patches).
gh02t 9y ago
I believe git uses its own implementation for applying deltas sucked down by `git pull` https://github.com/git/git/blob/master/patch-delta.c There's also `git apply` that applies user supplied patchfiles but if I'm reading this correctly it also uses an internal implementation: https://github.com/git/git/blob/master/apply.c

gregoriol 9y ago

Does this mean that it would be dangerous to try to patch patch?

secure 9y ago

I don’t have ed installed (not a conscious decision), which prevents this from working: % patch<evil.patch sh: 1: ed: not found patch: ed FAILED patch works just fine for me, though, so ed is not required.

cbr 9y ago
What distribution? (I don't think I've ever used a system that didn't have ed installed by default.)
- jwilk 9y ago
  Debian doesn't install ed by default, although it did in the past: https://bugs.debian.org/416585 https://bugs.debian.org/416585
- checkyoursudo 9y ago
  My install of Gentoo Linux doesn't have ed. It is available in the packages, of course.
- sothym 9y ago
  Arch Linux doesn't contain ed in their base package group.
- jethro_tell 9y ago
  my arch/ubuntu/debian/rh hosts don't have it pre installed. It's installed by default in an aLinux instance though.
- zaarn 9y ago
  Arch and Debian and Alpine Linux, to my knowledge. Which is sad because technically POSIX wants ed installed so purely technically, those distros aren't fully POSIX compliant.
ben_bai 9y ago
Patch applies files created with diff. Diff has 4 different output formats. One of those formats is basically a batch script with ed instructions. For patch to work correctly you have to allow executing ed commands (internally or by spawning ed) but for security reasons you better not let ed execute yet another program.

eridius 9y ago

Why does patch call ed? What did anyone ever actually use this for?

schoen 9y ago
Edit: I'm replacing my somewhat vague reply with a more correct answer: https://en.wikipedia.org/wiki/Diff_utility#Edit_script https://en.wikipedia.org/wiki/Diff_utility#Edit_script
LukeShu 9y ago
The `patch` program is expected to be able to apply any patchfile syntaxes created by `diff`. Once upon a time, the default behavior of diff was to spit out an `ed` script (nowadays, it's behind the `-e` flag). So, to apply that syntax of patchfile, it invokes `ed`.
zokier 9y ago
Unix principle of small tools chained together.

jimrandomh 9y ago

This is bad and should be fixed, but there are fairly few circumstances where it actually creates a new vulnerability. The majority of uses of patch are applied to source code by someone who's going to end up running that code anyways, so applying patches you haven't read closely from sources you don't trust is already unsafe.

simlevesque 9y ago
You could build the binary on your machine and run it inside a VM.
- zitterbewegung 9y ago
  To be honest qubes seems to become a better and better idea to run all of the time.
- petters 9y ago
  The patch could also modify the Makefile (or similar) to run arbitrary commands when the build is started.
archgoon 9y ago
The main place where this would be an issue would be if you have a server that is not going to build or run code, but applies patches to source and outputs the result. So a cr review website could be affected.
tzs 9y ago
> The majority of uses of patch are applied to source code by someone who's going to end up running that code anyways, so applying patches you haven't read closely from sources you don't trust is already unsafe. I think you are overlooking a case that I suspect is common: applying a patch without reading the patch source and then using your source code control system to review what the patch did. That lets you review that patch using whatever tools you normally use for reviewing code changes, which are often much nicer than reading a raw ed script.

yiyus 9y ago

This is, of course, a vulnerability. But let's not get too crazy. Once you are applying a patch, either you trust the patch or not. If you blindly apply patches, you will be in risk as soon as you run or try to compile the patched command. This attack is just a bit faster because it happens as soon as you apply the patch.

schoen 9y ago
Suppose you're applying patches to something other than software?
0x0 9y ago
What if you're trying to apply a patch to a .txt document?
mrob 9y ago
Patch isn't only used for source code. I wouldn't have expected any risk of malicious code execution if I was patching documentation.
- jwilk 9y ago
  Even for source, you may want to review the patch after applying it. For example, dpkg-source applies patches when you unpack source package. I don't think anybody expects code execution when unpacking stuff, even when this stuff is untrusted.

zitterbewegung 9y ago

This hole needs a fancy name. Patchowned? Pwneded ?

gruez 9y ago
PatchEd
paulie_a 9y ago
No, just no. Naming vulns is a theme that needs to go away
- sigjuice 9y ago
  Agreed. Every mundane bug or misfeature doesn't need its own website or 20-page analysis. Fix things and move on to the next thing that needs fixing. There is an endless supply of broken things.
  - paulie_a 9y ago
    To be fair I can appreciate the technical analysis of a security issue. The marketing is useless and just plain stupid
- flukus 9y ago
  I disagree, it's the only way to make the public aware of the issue and got the corporate hierarchy to expedite OS patching. Not that it's necessary in this case.
rachelbythebay 9y ago
I was hoping "bangpatch" (see URL). It's descriptive, and it's also a sly reference to the old-school days of UUCP.
gaius 9y ago
The Patch Snatch Batch

deleted 9y ago

[deleted]

volkadav 9y ago

similarly, i recall once being denied root on a host while trying to help out with something and then asking if i could at least have sudo less to look at things... which was granted. >:D (then i fixed the problem)

jacquesm 9y ago
Always nice to know more about the system than those nominally in charge of the system.

aplorbust 9y ago

"patch will attempt to determine the type of the diff listing, unless over-ruled by a -c, -e, -n, or -u option.Context diffs (old-style, new- style, and unified) and normal diffs are applied directly by the patch program itself, whereas ed diffs are simply fed to the ed(1) editor via a pipe." According to this, context diffs are not sent to ed. Is the author suggesting that patch can be fooled to interpret a context diff as an ed diff? Theres a file called pch.c with an excessive amount of parsing and "intuit" functions like intuit_diff_type(). patch has anthromorphised progress and error messages and tries to "guess". However I am only a dumb end user. I should not question what I do not understand. Its all safe I'm sure.

gbrown_ 9y ago

OpenBSD's patch handles ed style diffs internally now and also it is not permitted to execute other programs thanks to pledge. https://marc.info/?l=openbsd-cvs&m=144498099601083&w=2 https://marc.info/?l=openbsd-cvs&m=144498099601083&w=2

tantalor 9y ago

So patch can read email? https://en.wikipedia.org/wiki/Zawinski%27s_Law https://en.wikipedia.org/wiki/Zawinski%27s_Law

dfsegoat 9y ago
Off topic, and forgive my naivety & ignorance, but I really do not understand the highly specific nature of this Principle / Law, as it is on wiki: "Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can." ... was Mail just the example at the time? and this is basically just the a generic reference to feature/scope creep?... I just don't get the highly specific inclusion of "Reading mail" as something that all programs expand towards.
- khedoros1 9y ago
  Synecdoche. Mail stands in for the general class of popular features.
- jwilk 9y ago
  It's a joke about feature creep. Of course, most programs don't and shouldn't read mail. The choice of this particular feature was not accidental. JWZ was a developer of Netscape Mail: https://www.jwz.org/hacks/ https://www.jwz.org/hacks/
  - ryan-c 9y ago
    Copy/paste the link, do not click.
    - kstrauser 9y ago
      Why?
      - ReverseCold 9y ago
        Try it and you'll see why. It's not bad.

jwilk 9y ago

The beep bug on HN: https://news.ycombinator.com/item?id=16753013 https://news.ycombinator.com/item?id=16753013

vilhelm_s 9y ago

The whole (satirical) website https://holeybeep.ninja/ https://holeybeep.ninja/ is really great.

HIPisTheAnswer 9y ago

Torvalds argument against microkernel: 'But, performance!'. Result: QubesOS ...

seanhunter 9y ago

Patch knows that ed is a fine choice. Ed is generous enough to flag errors, yet prudent enough not to overwhelm the novice with verbosity. In case anyone has not been exposed to the reference, it's perhaps invoking the famous `ed, man !man ed` page. https://www.gnu.org/fun/jokes/ed-msg.html https://www.gnu.org/fun/jokes/ed-msg.html

rachelbythebay 9y ago
Crap! I knew I forgot something. I forgot to reference "eat flaming death". Oh well, good catch!
- orionblastar 9y ago
  We used that phrase in some Tradewar games during the BBS Era.
knodi123 9y ago
geez, towards the end that starts reading like my bottle of Dr Bronner's Soap

teeray 9y ago

So how long will it be before we have a Monero miner implementation in ed?

magwa101 9y ago

Real programmers use ed.

sigjuice 9y ago
Disagree :) $ cat >a.out EDIT: maybe not https://xkcd.com/378/ https://xkcd.com/378/

wodenokoto 9y ago

So, who is this Rachel, and why has her blog suddenly exploded on HN? Both old and new post have been filling the front page for about 2 weeks.

deleted 9y ago
[deleted]
derp12345 9y ago
I would also like to know the answer to this question. I enjoy the posts, generally, but I don't see why the sudden surge; there aren't even any ads (which is what I'd usually suspect)
- Piskvorrr 9y ago
  Popularity breeds popularity: user sees link on HN, browses around on the site, finds something else interesting, also submits it to HN, etc.
dang 9y ago
The blog has been appearing on HN for many years. I assume she just started publishing more lately.
- rachelbythebay 9y ago
  Yep. Getting out of a 'real job' released a whole bunch of cycles and there are a bunch of stories waiting to be told. I don't submit 'em ... I just write 'em.
Piskvorrr 9y ago
Try filtering around the discussions, she did mention having more time for writing recently.

DyslexicAtheist 9y ago

> This came up as part of the discussion on the "beep exploit" yesterday. I found it buried in the HN /new queue as a simple link to the Debian bug tracker. I was expecting this post to go through the roof and was rather surprised it gained zero traction, lol. Nobody using the GNU toolchain anymore on HN or it just got drowned out idk ... https://news.ycombinator.com/item?id=16766577 https://news.ycombinator.com/item?id=16766577

alex256148 9y ago

2nd Grader Brings Home Assignment Detailing Her White Privilege – ‘White Supremacy is All Whites’ http://acccurrent.info/other-information/2nd-grader-brings-home-assignment-detailing-her-white-privilege-white-supremacy-is-all-whites/ http://acccurrent.info/other-information/2nd-grader-brings-h...

brynet 9y ago

Text editors are shells, remember that if your program executes a text editor.

codedokode 9y ago

This is where unix philosophy fails. Patch should be editing files itself, not via an external program.

cryptonector 9y ago
This isn't the Unix philosophy at work. This is embedding a DSL. Microsot Office has the same exact problems, does it not? No Unix philosophy there.

cs702 9y ago

My reaction whenever I read things like the OP: https://blog.codinghorror.com/assets/images/codinghorror-app-icon.png?v=1162b121ab https://blog.codinghorror.com/assets/images/codinghorror-app...

hannob 9y ago

Here's the upstream bug report: https://savannah.gnu.org/bugs/index.php?53566 https://savannah.gnu.org/bugs/index.php?53566