Re: [PATCH v2] setup: tighten ownership checks post CVE-2022-24765

From: Phillip Wood <phillip.wood123@gmail.com>
Date: May 5, 2022, 12:04 UTC
Message-ID: <5d7ace7c-17d3-591d-6cca-ba5223449609@gmail.com>
In-Reply-To: <41ec8c09-f31f-46ce-d6ec-4b6fdd78228a@gmail.com>

On 05/05/2022 10:40, Phillip Wood wrote:

Show 13 quoted lines

> [...]
>> To avoid that, extend the ensure_valid_ownership function to be able to
>> check for ownership of both the worktree and the gitdir, and use that for
>> non bare repositories.
> 
> Looking at the code below it now only ever checks the ownership of the 
> gitdir, it no longer checks the ownership of the worktree. I haven't 
> really thought through what happens if I cd into a worktree added by an 
> attacker to a repository that I own which has extentions.worktreeConfig 
> set. My initial thought is that if they can add a worktree then they can 
> probably edit the repository config anyway but I wonder if an attacker 
> can set GIT_COMMON_DIR to a directory where they have write permission 
> to add a worktree to a repository where they don't have write permission.

Thinking about this some more, I don't think setting GIT_COMMON_DIR while running "git worktree add" will help an attacker as the worktree's gitdir is created under the main gitdir. I've had a bit of a think and I've not been able to come up with a senario where GIT_DIR and GIT_COMMON_DIR have different owners that is exploitable but it might be worth someone else checking I've not missed something.

Best Wishes

Phillip