CVE-2018-1000156

GNU Patch is a common tool used to apply updates to software files using “patch” files. With CVE-2018-1000156, a specially crafted patch file can trick the tool into running code instead of just applying changes. Think of it like a file format meant for safe “instructions,” but an attacker can make those instructions trigger a command run instead.

This matters if you run the patch utility from GNU Patch version 2.7.6 (on systems such as Debian/Ubuntu/Red Hat Enterprise Linux and related distributions). It does not require a login to start the risk in general, but it does require a patch file to be processed (the user/process has to apply it), and the exact “reachable in default config” condition is not known from the provided findings. Practically, treat it as a risk mainly if your business workflow applies patch files from untrusted sources or automated pipelines can ingest untrusted patch content.

Verdict: AMBER. Attackers can exploit this with a malicious patch file, and a public exploit is available, so the risk rises quickly in environments where untrusted patch files are processed. It is not described as an automatic remote risk, but patch-file handling is common in build, maintenance, and software-update workflows.

Confirm exposure

• Identify the exact GNU Patch version installed:
  • Run patch --version and confirm the version is 2.7.6.
  • If your environment uses distribution packages, verify the package version for the patch utility.

Upgrade to the fix

• If you are on GNU Patch 2.7.6, upgrade to a version newer than 2.7.6 via your operating system’s package updates.
• Vendor remediation guidance is referenced here: https://savannah.gnu.org/bugs/index.php?53566
• For Debian/Ubuntu and similar distributions: use your distro’s recommended update path for the patch package (apply the latest available package update that is newer than 2.7.6).

Temporary workaround (if patching is delayed)

• Do not apply patch files from untrusted sources (email attachments, public websites, random issue threads).
• Restrict which users/systems can fetch and apply patches, and ensure patch files in CI/build pipelines come only from trusted, authenticated sources.

What to monitor

• Look for build/maintenance jobs that download patch files and then run patch on them.
• Review any recent pipeline logs for where patch files came from (repository origin, artifacts store, ticket attachments).

Due date

• No CISA KEV listing was provided for this CVE, so no KEV-specific public deadline applies from the findings you shared.

Severity: High (code execution; findings state capability is Code Execution).

Mechanism / weakness: CWE-20 (improper input validation). The vulnerability is triggered when GNU Patch processes a crafted patch file that leads to unsafe EDITOR_PROGRAM/ed invocation with unsanitized input.

Attack vector and prerequisites: Local in the sense that code executes on the machine running patch. Findings also state authentication is not required, but user/process interaction is required—someone or some process must process the malicious patch file. Preconditions: the target must run GNU Patch 2.7.6.

Exploitation status: A public exploit is available (1 known). KEV was not listed.

EPSS: A predicted likelihood was provided (trend: falling), but because KEV is not listed in the findings, treat this as only a likelihood indicator rather than confirmation of widespread exploitation.

What KEV means here: KEV (CISA Known Exploited Vulnerabilities) would indicate confirmed active exploitation by evidence; it was not provided for this CVE in the findings.