Executive brief
Mercurial is a distributed version control system used by development teams to manage source code. An integer overflow vulnerability in the patch application logic (mpatch.c) can allow an attacker to cause a buffer underflow or memory corruption when processing specially crafted patch files, potentially enabling arbitrary code execution or service disruption.
Technical details
The vulnerability exists in mpatch.c in Mercurial before version 4.6.1, where integer addition and subtraction operations are not properly validated, leading to integer overflow conditions (CWE-190). The vulnerable mpatch_apply() function mishandles fragment position calculations when processing binary patches, causing a buffer underflow. An attacker can craft a malicious patch file that, when applied by Mercurial, triggers the overflow and corrupts memory. No authentication or special privileges are required; the attack only requires an attacker to supply a malicious patch file to a Mercurial repository. Patches are available in Mercurial 4.6.1 and later.
Affected products
- Mercurial Mercurial before 4.6.1
Timeline
- 2018-07-06: disclosed
- 2018-06-06: patched: Mercurial 4.6.1 released