Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git: Malicious repositories can execute remote code while cloning

openwall.com

Post reply on HN
Print view View original

121–130 of 228 posts

Re: Git: Malicious repositories can execute remote code while cloning

#121

Post by hctaw »

remram wrote: post #120
kazinator wrote: post #86

That could be any Git repository. Have you seen the mayhem that some of mine cause when you clone them and then type ./configure && make, like you have been socially engineered into doing?

For a while I tried to only run untrusted builds in Docker containers, like doing `docker run -v $PWD:/src node npm install`, but IDEs are not really configured to deal with this. Even my Vim has ALE and would just run node_modules/.bin/tsserver on my machine, which could be anything. Why aren't our tools concerned with this at all?

Because at a certain point you shrug and blame the user for downloading sketchy code and executing it.

Re: Git: Malicious repositories can execute remote code while cloning

#122

Post by junon »

SilverRed wrote: post #50
jonas21 wrote: post #49

Earlier quoted context omitted.

Why is it meaningless? Lots of people use Git on MacOS and Windows. I'd even be willing to bet that there are more people using Git on MacOS and Windows than Linux.

And use git LFS and cloned a malicious repo? This bug has probably not affected a single user.

That's not why we do security research.

Re: Git: Malicious repositories can execute remote code while cloning

#123

Post by matheust »

dragonwriter wrote: post #101
matheust wrote: post #99

Earlier quoted context omitted.

> What is the simple test for whether this is the case or not? As suggested in GitHub's announcement post[1], you can test this with the following: `git config --show-scope --get-regexp 'filter\..*\.process'` (replace the single quotes by double quotes on Windows Command Prompt) > Is this a default-on scenario? On Windows yes, because Git-for-Windows configures Git LFS by default. [1]: https://github.blog/2021-03-09-…

Doesn't Git-for-Windows default configure symbolic link support off, though? Or does this exploit work even in that case as long as the underlying file system supports symlinks?

Git-for-Windows may turn symlink support on by default under some specific circumstances. As the repo's wiki [1] says:

Short version: there is no exact equivalent for POSIX symlinks on Windows, and the closest thing is unavailable for non-admins by default unless Developer Mode is enabled and a relatively recent Windows 10 version is used. Therefore, symlink emulation support is only turned on by default when that scenario is detected.

[1]: https://github.com/git-for-windows/git/wiki/Symbolic-Links

Re: Git: Malicious repositories can execute remote code while cloning

#124

Post by Wowfunhappy »

caslon wrote: post #46
chungy wrote: post #45

Earlier quoted context omitted.

There are many options for case-insensitivity on Linux. The common one would be FAT, which can't handle symbolic links, so that is moot. There is also ext4 and ZFS that can have case-insensitive modes enabled (they aren't by default), which do support symbolic links. ntfs-3g also has an option to mount as case-insensitive (though said option can actually subtly break access to an NTFS volume, since NTFS itself is alw…

Yes, but no sensible people use case-insensitivity on Linux, and the amount of other people that do in a relevant context can probably be measured with four digits.

May I ask why?

Case sensitivity is one of the things that really bothers me on Linux, it causes me to make mistakes for no reason. If I ever really switched to Linux full-time, I’d probably want to change that.

Re: Git: Malicious repositories can execute remote code while cloning

#125

Post by Wowfunhappy »

fulafel wrote: post #117
jrockway wrote: post #90

Earlier quoted context omitted.

I don't think that smugly not running as root saves normal users; while malware running as your user can't trash your laptop, they can get your Google cookie and read and send emails as you, spend your money, view your private photos, etc.

And it can run sudo as your user after you warm it up. Or use any number of frequently disclosed OS vulnerabilities for local privilege escalation.

> And it can run sudo as your user after you warm it up.

How is it getting my root password?

Re: Git: Malicious repositories can execute remote code while cloning

#126

Post by eru »

anyfoo wrote: post #106
bin_bash wrote: post #103

Earlier quoted context omitted.

Cache is a type of state but not necessarily the other way around

In the efficient implementation of a pure functional language (say Haskell without MVars), what really is the difference between state and cache? I know this is overly philosophical, and in practical scenarios we readily (although not always unambiguously) differentiate between "cache" and "state", but the point about transitions and that being a major source of bugs still stands.

> In the efficient implementation of a pure functional language (say Haskell without MVars), what really is the difference between state and cache?

If you want to unify state and cache, you might want to go down a different route:

Think of log based filesystems (or a log based data base).

Instead of defining your operations in terms of state, you define them as pure functions of the log.

So your log is full of operations. Writing just means appending a symbolic operation like `write(key, value)` to your log.

And you define the result of `read(key)`: scan backwards through the log until you hit the last instance of `write(x, value)` and the return that `value`.

Now state means: compact your log by replacing a swath of `write` log entries with one big `snapshot` operation that encompasses many key/value pairs.

Alternatively, you can also define state to mean caching your `read` operations.

In this approach, it's no coincidence that the log is a data structure that has a linear shape: the evolution of state over time is also linear.

(With some cleverness you can replace the linear structure with eg a DAG; and then also think about how you merge divergent states.)

Re: Git: Malicious repositories can execute remote code while cloning

#127

Post by edgyquant »

Wowfunhappy wrote: post #125
fulafel wrote: post #117

Earlier quoted context omitted.

And it can run sudo as your user after you warm it up. Or use any number of frequently disclosed OS vulnerabilities for local privilege escalation.

> And it can run sudo as your user after you warm it up. How is it getting my root password?

I set sudo to NOPASSWD, so it doesn’t need one for my workstation

Re: Git: Malicious repositories can execute remote code while cloning

#128

Post by eru »

segfaultbuserr wrote: post #30
stefan_ wrote: post #17

The commit that fixes this issue: https://github.com/gitster/git/commit/684dd4c2b414bcf648505e... (Surprise, the root cause is a cache )

Difficult problems in programming: (1) cache invalidation (2) off-by-one errors

Fortunately, many off-by-one errors can be caught with more ergonomic tooling.

For the simplest example: compare the old C-style for loop vs a Python style for-each loop.

Re: Git: Malicious repositories can execute remote code while cloning

#129

Post by eru »

de6u99er wrote: post #111
stefan_ wrote: post #17

The commit that fixes this issue: https://github.com/gitster/git/commit/684dd4c2b414bcf648505e... (Surprise, the root cause is a cache )

Strange. The guy who fixed the issue works at Microsoft, but uses his gmx email for Github.

I think you just got a glimpse of a vast sea of internal policy and compliance issues.

Re: Git: Malicious repositories can execute remote code while cloning

#130

Post by Agentlien »

stefan_ wrote: post #17

The commit that fixes this issue: https://github.com/gitster/git/commit/684dd4c2b414bcf648505e... (Surprise, the root cause is a cache )

I am really fascinated by the responses to this comment. So many people exclaiming how many issues are caused by caches. In ten years as a fulltime programmer the only cache issues I've seen are cache misses. It probably has to do with one's field. I'm a game developer mainly dealing with graphics programming.
Post reply on HN