Heap Overflow in GNU patch via Malformed Hunk Offset

Executive Summary

GNU patch is vulnerable to a denial of service (DoS) due to improper validation of hunk line offsets in unified-diff input.

A specially crafted patch can specify an extremely large line number, causing the application to enter an effectively infinite processing loop while attempting to locate the requested position.

This results in excessive CPU consumption and prevents the process from completing.

An attacker can trigger this behavior by supplying a malicious patch file, causing the utility to become unresponsive and require manual termination.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the GNU patch utility to become unresponsive due to an infinite processing loop triggered by a malicious patch file.

The impact is a denial of service (DoS) where the process consumes excessive CPU resources and does not complete its operation.

Users or systems relying on GNU patch for automated patching or updates may experience interruptions or failures requiring manual intervention to terminate the process.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability in GNU patch manifests as a denial of service caused by excessive CPU consumption when processing a specially crafted patch file with extremely large line numbers in unified-diff input.

Detection can involve monitoring for unusually high CPU usage by the patch utility or processes invoking it, especially when applying patch files.

Since the vulnerability is triggered by malicious patch files, inspecting patch files for abnormally large line numbers in hunks could help identify potential exploits.

There are no specific commands provided in the resources to detect this vulnerability directly.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been fixed in the commit faba04ef4f2b410257f76c1b9dc85e350929c4b9.

Immediate mitigation involves updating GNU patch to a version that includes this fix.

Until the update can be applied, avoid applying untrusted or suspicious patch files that could contain maliciously crafted hunks with large line offsets.

Monitoring and terminating any patch processes that become unresponsive due to excessive CPU usage can also help mitigate impact.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in GNU patch causes a denial of service (DoS) through excessive CPU consumption and an infinite processing loop when handling specially crafted patch files.

There is no information provided in the context or resources about any impact on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0