From: Phillip Wood <phillip.wood123@gmail.com>
Date: Thu, 05 May 2022 12:04:21 GMT
Subject: Re: [PATCH v2] setup: tighten ownership checks post CVE-2022-24765
Message-ID: <5d7ace7c-17d3-591d-6cca-ba5223449609@gmail.com>
In-Reply-To: <41ec8c09-f31f-46ce-d6ec-4b6fdd78228a@gmail.com>

On 05/05/2022 10:40, Phillip Wood wrote:
> [...]
>> To avoid that, extend the ensure_valid_ownership function to be able to
>> check for ownership of both the worktree and the gitdir, and use that for
>> non bare repositories.
> 
> Looking at the code below it now only ever checks the ownership of the 
> gitdir, it no longer checks the ownership of the worktree. I haven't 
> really thought through what happens if I cd into a worktree added by an 
> attacker to a repository that I own which has extentions.worktreeConfig 
> set. My initial thought is that if they can add a worktree then they can 
> probably edit the repository config anyway but I wonder if an attacker 
> can set GIT_COMMON_DIR to a directory where they have write permission 
> to add a worktree to a repository where they don't have write permission.

Thinking about this some more, I don't think setting GIT_COMMON_DIR 
while running "git worktree add" will help an attacker as the worktree's 
gitdir is created under the main gitdir. I've had a bit of a think and 
I've not been able to come up with a senario where GIT_DIR and 
GIT_COMMON_DIR have different owners that is exploitable but it might be 
worth someone else checking I've not missed something.

Best Wishes

Phillip