CVE-2018-13347

Vulnerability

An integer handling flaw exists in the mpatch.c file of Mercurial versions prior to 4.6.1 [1]. The vulnerability is due to incorrect handling of integer addition and subtraction operations, which can lead to an integer overflow or underflow [3]. This issue affects all Mercurial releases before the 4.6.1 minor release, which was published on 2018-06-06 [1].

Exploitation

An attacker can trigger the vulnerability by providing a specially crafted input that causes the manipulated integer operations in the mpatch binary diff code to exceed their intended bounds [1][3]. The attack likely requires the target to process a malicious patch or repository operation that invokes the mpatch functionality, potentially through a network clone or pull operation [2].

Impact

Successful exploitation can result in a denial-of-service condition due to application crash or, in some scenarios, memory corruption that could be leveraged for further compromise [3]. The outcome depends on the specific integer miscalculation and its effect on buffer operations within the mpatch code.

Mitigation

The vulnerability is fixed in Mercurial version 4.6.1, released on 2018-06-06 [1]. Users should upgrade to this version or later. Red Hat Enterprise Linux users can apply the fix via RHSA-2019:2276 [2]. No workaround is documented in the available references; applying the patch is the recommended action.