7 ms·

> This vulnerability affects platforms with case-insensitive filesystems with support for symbolic links, when certain clean/smudge filters are configured globa

by caslon 6y ago

> This vulnerability affects platforms with case-insensitive filesystems with support for symbolic links, when certain clean/smudge filters are configured globally (e.g. Git LFS). Can we get the title changed to "on macOS and Windows?" I was worried for a second, but this is meaningless.

jonas21 6y ago
Why is it meaningless? Lots of people use Git on MacOS and Windows. I'd even be willing to bet that there are more people using Git on MacOS and Windows than Linux.
- SilverRed 6y ago
  And use git LFS and cloned a malicious repo? This bug has probably not affected a single user.
  - jonas21 6y ago
    Isn't the whole point of announcing security patches so that people can update before they're exploited?
    - SilverRed 6y ago
      Sure, I'm just saying this isn't a big deal and its likely no one was hit.
      - aiisjustanif 6y ago
        Just because there is not an active threat doesn’t make it any less of a vulnerability to be exploited.
        lucb1e 6y ago
        It does if nobody uses it. You can't exploit Apache 2.4.2 proxy bugs if nobody runs Apache 2.4.2 in proxy mode. Of course, you should still update because you're a config change away from being vulnerable, but GP's point of it not being a big deal if (and only if, don't know if that's correct) nobody uses it stands.
  - CamJN 6y ago
    The GitHub desktop app configures lfs in your gitconfig automatically, so that adds a lot of users to the vulnerable pool.
  - anaisbetts 6y ago
    Many Git distributions come with git-lfs installed by default
  - geofft 6y ago
    I assume the primary user base of git-lfs is folks doing things like video game development (so that they can check in image/audio assets to a repo without massively bloating it), which probably has a much higher fraction of Mac/Windows users than folks writing server-side apps or whatever.
  - junon 6y ago
    That's not why we do security research.
- trollian 6y ago
  I would assume that most people developing on macOS have configured case sensitive filesystems. And does Windows do symlinks now? Seems like a weird edge case to me. I guess Apple and Microsoft should push out OS updates to cover it.
  - emodendroket 6y ago
    Windows has done symlinks (known as "junctions") since Windows 2000, so I guess it's a more recent feature you might not have learned about.
    - lucb1e 6y ago
      To be honest I was a heavy Windows user until Windows 7 yet only recently learned that it has symlink support. It's not something you (used to?) really come across in the ecosystem. That said, I did snicker at the comment :) I had no idea it was that old.
    - memorysafety 6y ago
      That's a dishonest statement and misrepresents the actual support. The "junctions" are unusable as "windows symlinks". For one, you can't create any as a normal non-admin user without specific authorization by default.
      - emodendroket 6y ago
        Only the most sadistic company on earth is going to ask you to do development on a Windows machine without admin privileges.
        memorysafety 6y ago
        I had exactly that done to me. By a huge 200k+ employees corporate monster... You can taste the humiliation of having to justify every sudo through a ticket system. They censored the internet for employees too, in an of course absurdly broken way. Made me learn to read ASN.1 printouts & detect tampering with TLS certs. Add to that an iconic "Office Space"-ey workplace atmosphere, absolutely toxic... made me _request a headset_ from the company (employees are not allowed to bring their own); 2 weeks of ticketing again, and they deliver: an rj45-plug phone headset, with three obscure boxes on the wire (I can only presume, for surveillance). I've been testing my limits for 3 months with them, and left without saying a word. A lesson is a lesson.
chungy 6y ago
There are many options for case-insensitivity on Linux. The common one would be FAT, which can't handle symbolic links, so that is moot. There is also ext4 and ZFS that can have case-insensitive modes enabled (they aren't by default), which do support symbolic links. ntfs-3g also has an option to mount as case-insensitive (though said option can actually subtly break access to an NTFS volume, since NTFS itself is always case-sensitive and it's just the OS's VFS layer that pretends otherwise).
- caslon 6y ago
  Yes, but no sensible people use case-insensitivity on Linux, and the amount of other people that do in a relevant context can probably be measured with four digits.
  - chungy 6y ago
    I have case-insensitivity enabled for DOSBox and Wine file systems. I've actually thought about converting my whole $HOME to that way, but I do have a few files that would conflict if I did that. I honestly don't think it's that bad of an idea.
    - nicoburns 6y ago
      Do you store code in $HOME. If so, I wouldn't recommend it. I have a case-sensitive partition on my macOS machine because I was bitten one too many times by code that worked fine on my development machine (case-insensitive file system) only to fail in production (case-sensitive file system).
      - chungy 6y ago
        That would indeed be one reason (aside from sheer time) I've avoided doing it fully.
  - JeremyNT 6y ago
    I've had git repositories on vfat formatted usb drives before. This isn't something I do with much frequency but it's not that exotic of a use case. There's also the possibility of a git repo on a SMB share. That's not a use case I have, but it's not too difficult to imagine in a corporate environment.
deleted 6y ago
[deleted]
krick 6y ago
Yep, I sensed a similar relaxation when reading this. But whatever, don't be silly, title it long enough as it is. Anyway, what I'm actually thinking when something like this is disclosed is how many more similar things must be known to a team of malicious professionals at Unit 8200 or whatever. I don't think I would reasonably suspect "git clone" being capable of something like that. How many more things I don't suspect to be dangerous actually are? It feels almost pointless to worry about it.
fortran77 6y ago
You'd be hard-pressed to get this on Windows/NTFS because of the way symbolic links work and if they're implemented as a link or a junction. This is really a macOS problem.
lelanthran 6y ago
> Can we get the title changed to "on macOS and Windows?" That isn't correct; it's a bug that manifests on case-insensitive[1] filesystems. My colleagues who run a linux VM (our product targets Linux only) tend to git-clone onto a mounted NTFS partition so they can access the source from both host and guest. This bug will affect them even though they are running on Linux. My other colleagues who run an actual Linux box tend to use a fast removable drive to git-clone (so they can work on it from home), and said drives tend to be FAT, which will also be susceptible to this bug. If, on the third hand, you're running Windows and using ext4 as a filesystem (removable drive, mounted partition, whatever), then this bug should not affect you. TLDR; the OS doesn't matter, the filesystem does. [1] They aren't, not really; NTFS is case-sensitive! It preserves the case when writing filenames and ignores it when reading filenames.

by caslon 6y ago

jonas21 6y ago

Why is it meaningless? Lots of people use Git on MacOS and Windows. I'd even be willing to bet that there are more people using Git on MacOS and Windows than Linux.

SilverRed 6y ago
And use git LFS and cloned a malicious repo? This bug has probably not affected a single user.
- jonas21 6y ago
  Isn't the whole point of announcing security patches so that people can update before they're exploited?
  - SilverRed 6y ago
    Sure, I'm just saying this isn't a big deal and its likely no one was hit.
    - aiisjustanif 6y ago
      Just because there is not an active threat doesn’t make it any less of a vulnerability to be exploited.
      - lucb1e 6y ago
        It does if nobody uses it. You can't exploit Apache 2.4.2 proxy bugs if nobody runs Apache 2.4.2 in proxy mode. Of course, you should still update because you're a config change away from being vulnerable, but GP's point of it not being a big deal if (and only if, don't know if that's correct) nobody uses it stands.
- CamJN 6y ago
  The GitHub desktop app configures lfs in your gitconfig automatically, so that adds a lot of users to the vulnerable pool.
- anaisbetts 6y ago
  Many Git distributions come with git-lfs installed by default
- geofft 6y ago
  I assume the primary user base of git-lfs is folks doing things like video game development (so that they can check in image/audio assets to a repo without massively bloating it), which probably has a much higher fraction of Mac/Windows users than folks writing server-side apps or whatever.
- junon 6y ago
  That's not why we do security research.
trollian 6y ago
I would assume that most people developing on macOS have configured case sensitive filesystems. And does Windows do symlinks now? Seems like a weird edge case to me. I guess Apple and Microsoft should push out OS updates to cover it.
- emodendroket 6y ago
  Windows has done symlinks (known as "junctions") since Windows 2000, so I guess it's a more recent feature you might not have learned about.
  - lucb1e 6y ago
    To be honest I was a heavy Windows user until Windows 7 yet only recently learned that it has symlink support. It's not something you (used to?) really come across in the ecosystem. That said, I did snicker at the comment :) I had no idea it was that old.
  - memorysafety 6y ago
    That's a dishonest statement and misrepresents the actual support. The "junctions" are unusable as "windows symlinks". For one, you can't create any as a normal non-admin user without specific authorization by default.
    - emodendroket 6y ago
      Only the most sadistic company on earth is going to ask you to do development on a Windows machine without admin privileges.
      - memorysafety 6y ago
        I had exactly that done to me. By a huge 200k+ employees corporate monster... You can taste the humiliation of having to justify every sudo through a ticket system. They censored the internet for employees too, in an of course absurdly broken way. Made me learn to read ASN.1 printouts & detect tampering with TLS certs. Add to that an iconic "Office Space"-ey workplace atmosphere, absolutely toxic... made me _request a headset_ from the company (employees are not allowed to bring their own); 2 weeks of ticketing again, and they deliver: an rj45-plug phone headset, with three obscure boxes on the wire (I can only presume, for surveillance). I've been testing my limits for 3 months with them, and left without saying a word. A lesson is a lesson.

chungy 6y ago

There are many options for case-insensitivity on Linux. The common one would be FAT, which can't handle symbolic links, so that is moot. There is also ext4 and ZFS that can have case-insensitive modes enabled (they aren't by default), which do support symbolic links. ntfs-3g also has an option to mount as case-insensitive (though said option can actually subtly break access to an NTFS volume, since NTFS itself is always case-sensitive and it's just the OS's VFS layer that pretends otherwise).

caslon 6y ago
Yes, but no sensible people use case-insensitivity on Linux, and the amount of other people that do in a relevant context can probably be measured with four digits.
- chungy 6y ago
  I have case-insensitivity enabled for DOSBox and Wine file systems. I've actually thought about converting my whole $HOME to that way, but I do have a few files that would conflict if I did that. I honestly don't think it's that bad of an idea.
  - nicoburns 6y ago
    Do you store code in $HOME. If so, I wouldn't recommend it. I have a case-sensitive partition on my macOS machine because I was bitten one too many times by code that worked fine on my development machine (case-insensitive file system) only to fail in production (case-sensitive file system).
    - chungy 6y ago
      That would indeed be one reason (aside from sheer time) I've avoided doing it fully.
- JeremyNT 6y ago
  I've had git repositories on vfat formatted usb drives before. This isn't something I do with much frequency but it's not that exotic of a use case. There's also the possibility of a git repo on a SMB share. That's not a use case I have, but it's not too difficult to imagine in a corporate environment.

deleted 6y ago

[deleted]

krick 6y ago

Yep, I sensed a similar relaxation when reading this. But whatever, don't be silly, title it long enough as it is. Anyway, what I'm actually thinking when something like this is disclosed is how many more similar things must be known to a team of malicious professionals at Unit 8200 or whatever. I don't think I would reasonably suspect "git clone" being capable of something like that. How many more things I don't suspect to be dangerous actually are? It feels almost pointless to worry about it.

fortran77 6y ago

You'd be hard-pressed to get this on Windows/NTFS because of the way symbolic links work and if they're implemented as a link or a junction. This is really a macOS problem.

lelanthran 6y ago

> Can we get the title changed to "on macOS and Windows?" That isn't correct; it's a bug that manifests on case-insensitive[1] filesystems. My colleagues who run a linux VM (our product targets Linux only) tend to git-clone onto a mounted NTFS partition so they can access the source from both host and guest. This bug will affect them even though they are running on Linux. My other colleagues who run an actual Linux box tend to use a fast removable drive to git-clone (so they can work on it from home), and said drives tend to be FAT, which will also be susceptible to this bug. If, on the third hand, you're running Windows and using ext4 as a filesystem (removable drive, mounted partition, whatever), then this bug should not affect you. TLDR; the OS doesn't matter, the filesystem does. [1] They aren't, not really; NTFS is case-sensitive! It preserves the case when writing filenames and ignores it when reading filenames.