CVE-2018-13348

Vulnerability

The vulnerability resides in the mpatch_decode function in mpatch.c of Mercurial. The function mishandles situations where at least 12 bytes are expected to remain after the current position in patch data, but fewer bytes are actually available. This leads to a heap buffer over-read. All versions of Mercurial before 4.6.1 are affected [1][2].

Exploitation

An attacker can trigger this vulnerability by supplying a specially crafted patch file to a vulnerable Mercurial instance. The attacker does not need any special privileges; the vulnerability can be triggered simply by applying a malicious patch or cloning a repository that contains such a patch. No user interaction beyond normal repository operations is required [2].

Impact

Successful exploitation results in a heap buffer over-read, which could allow an attacker to read out-of-bounds memory. This may lead to information disclosure of sensitive data in the heap, and under certain conditions could be leveraged for further attacks. The precise impact depends on the heap layout and the data present in adjacent memory [2].

Mitigation

The vulnerability is fixed in Mercurial version 4.6.1, which was released on 2018-06-06 [1]. Users should upgrade to Mercurial 4.6.1 or later. No workarounds are known for unpatched versions [1][2].