CVE-2018-13346

Vulnerability

The mpatch_apply function in mpatch.c in Mercurial before version 4.6.1 (released 2018-06-06) improperly proceeds with a binary patch when the fragment start offset exceeds the length of the original data. This condition, tracked as OVE-20180430-0004, allows a crafted patch to trigger an out-of-bounds memory access during the application of MPatch deltas. The bug affects all Mercurial versions prior to 4.6.1 as indicated by the advisory [1][4].

Exploitation

An attacker must craft a malicious MPatch binary patch where at least one fragment specifies a start position beyond the end of the original data buffer. The attack can be delivered remotely if a victim clones or pulls a repository containing such a patch from an untrusted source, or locally if a user applies a patch file with the crafted content. No special authentication or user interaction beyond applying the patch is required; the vulnerable code path is reached during normal patching operations [1][3].

Impact

Successful exploitation causes the mpatch_apply function to read memory outside the intended buffer (out-of-bounds read). This can result in a crash (denial of service) or, in some configurations, disclosure of sensitive heap memory contents (information disclosure). The attacker does not gain code execution directly, but the leaked memory may contain credentials or other private data [3][4].

Mitigation

Mercurial 4.6.1, released on 2018-06-06, contains the fix for this vulnerability [1]. Users are advised to upgrade to Mercurial 4.6.1 or later. Red Hat Enterprise Linux users can apply the patch via RHSA-2019:2276 [2]. No workaround is available for unpatched versions. If an upgrade cannot be performed immediately, avoid applying patches from untrusted sources [1][2].