Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git: Malicious repositories can execute remote code while cloning

openwall.com

Post reply on HN
Print view View original

141–150 of 228 posts

Re: Git: Malicious repositories can execute remote code while cloning

#141

Post by lucb1e »

emodendroket wrote: post #96
trollian wrote: post #74

Earlier quoted context omitted.

I would assume that most people developing on macOS have configured case sensitive filesystems. And does Windows do symlinks now? Seems like a weird edge case to me. I guess Apple and Microsoft should push out OS updates to cover it.

Windows has done symlinks (known as "junctions") since Windows 2000, so I guess it's a more recent feature you might not have learned about.

To be honest I was a heavy Windows user until Windows 7 yet only recently learned that it has symlink support. It's not something you (used to?) really come across in the ecosystem.

That said, I did snicker at the comment :) I had no idea it was that old.

Re: Git: Malicious repositories can execute remote code while cloning

#142

Post by brundolf »

stefan_ wrote: post #17

The commit that fixes this issue: https://github.com/gitster/git/commit/684dd4c2b414bcf648505e... (Surprise, the root cause is a cache )

It's amazing how often exploits come down to optimizations. The general form being "the domain logic is X, and is secure, but we faked around it in this one case to make it faster, and it turns out we made a bad assumption while doing so". Meltdown fits this description too.

Re: Git: Malicious repositories can execute remote code while cloning

#143

Post by kazinator »

minitech wrote: post #119
kazinator wrote: post #86

That could be any Git repository. Have you seen the mayhem that some of mine cause when you clone them and then type ./configure && make, like you have been socially engineered into doing?

There is a huge difference between “clone a repo” and “clone a repo and run code from it”.

In spite of my tongue-in-cheek statement, I get it.

It's huge in the context of non-programming uses of Git. If some people are just sharing some text documents with Git, then it's a big deal.

This is likely on the rise.

E.g. if you look at a site like Github, there is a lot of non-code content in it. Some people stash that content, and other people believe that content to just be harmless files that will never perpetrate an exploit just from being cloned.

Re: Git: Malicious repositories can execute remote code while cloning

#144

Post by thelopa »

Wowfunhappy wrote: post #125
fulafel wrote: post #117

Earlier quoted context omitted.

And it can run sudo as your user after you warm it up. Or use any number of frequently disclosed OS vulnerabilities for local privilege escalation.

> And it can run sudo as your user after you warm it up. How is it getting my root password?

Sudo persists authorization for a short period of time so that you don’t need to re-authorize for back-to-back commands.

Also, once they get ACE they can modify your bashrc to make sudo an alias for “sudo rm -rf / ;” or all sorts of other evil trickery.

Re: Git: Malicious repositories can execute remote code while cloning

#145

Post by brundolf »

chungy wrote: post #45
caslon wrote: post #41

> This vulnerability affects platforms with case-insensitive filesystems with support for symbolic links, when certain clean/smudge filters are configured globally (e.g. Git LFS). Can we get the title changed to "on macOS and Windows?" I was worried for a second, but this is meaningless.

There are many options for case-insensitivity on Linux. The common one would be FAT, which can't handle symbolic links, so that is moot. There is also ext4 and ZFS that can have case-insensitive modes enabled (they aren't by default), which do support symbolic links. ntfs-3g also has an option to mount as case-insensitive (though said option can actually subtly break access to an NTFS volume, since NTFS itself is alw…

The exploit can also be done with (case-sensitive) Unicode file names. All it requires is that git thinks two paths are distinct, while the file system thinks they're equivalent

Re: Git: Malicious repositories can execute remote code while cloning

#146

Post by ironmagma »

Agentlien wrote: post #130
stefan_ wrote: post #17

The commit that fixes this issue: https://github.com/gitster/git/commit/684dd4c2b414bcf648505e... (Surprise, the root cause is a cache )

I am really fascinated by the responses to this comment. So many people exclaiming how many issues are caused by caches. In ten years as a fulltime programmer the only cache issues I've seen are cache misses. It probably has to do with one's field. I'm a game developer mainly dealing with graphics programming.

The key problem (as I understand it) is that updating a cache properly requires knowing the exact graph of relations that an entry in the cache has to other entries. So that when that entry changes, you can propagate that change throughout the cache to other concerned entries which need to be recomputed. But knowing that exact graph is too complex a task to be trivial, it seems in this case. Basically it sounds like the non-visual version of rerendering UI when a state changes, which is hard enough even with visual feedback.

Re: Git: Malicious repositories can execute remote code while cloning

#147

Post by dhosek »

emodendroket wrote: post #97
Jtsummers wrote: post #21

Earlier quoted context omitted.

macOS has defaulted to be case insensitive largely due to historical and perhaps usability reasons. You can opt to make it case sensitive (and I do, which broke Steam for several years but that also freed my time).

When necessary you can make an auto-expanding volume that's case-sensitive and leave your host FS alone. I have not found that I really want to have differently-cased but otherwise identical filenames in the real world at any point though.

Ages ago, I heard from co-workers at a company that I had left that there was an issue because of some file-naming in a PHP application that they were trying to run locally on a Mac. There was foo.php which was the interface and Foo.php which had a class definition in it.

What idiot would name files like that? I said.

You, they answered.

I don't do that sort of thing anymore.

Re: Git: Malicious repositories can execute remote code while cloning

#148

Post by lixtra »

stefan_ wrote: post #17

The commit that fixes this issue: https://github.com/gitster/git/commit/684dd4c2b414bcf648505e... (Surprise, the root cause is a cache )

> (Surprise, the root cause is a cache)

Couldn’t it just as well be attributed to improper file path normalization? If we had only lower case ASCII file systems it would not have caused a problem.

Re: Git: Malicious repositories can execute remote code while cloning

#149

Post by minitech »

jtsiskin wrote: post #135
minitech wrote: post #119

Earlier quoted context omitted.

There is a huge difference between “clone a repo” and “clone a repo and run code from it”.

Technically yes, but I can’t think of the last time I cloned a repo without then running code from it...

Well, I clone repos to inspect code all the time, and when I run code, it’s usually not with the same permissions as the corresponding `git clone`. Maybe I should be better about sandboxing Git…

Re: Git: Malicious repositories can execute remote code while cloning

#150

Post by minitech »

kazinator wrote: post #143
minitech wrote: post #119

Earlier quoted context omitted.

There is a huge difference between “clone a repo” and “clone a repo and run code from it”.

In spite of my tongue-in-cheek statement, I get it. It's huge in the context of non-programming uses of Git. If some people are just sharing some text documents with Git, then it's a big deal. This is likely on the rise. E.g. if you look at a site like Github, there is a lot of non-code content in it. Some people stash that content, and other people believe that content to just be harmless files that will never perpe…

It’s a big deal regardless of whether documents or code are being stored. Cloning a repo should not open you up to RCE.
Post reply on HN