CVE-2010-4651

What it actually does

Directory traversal in GNU patch allows crafted patch files containing .. or absolute paths to create or overwrite arbitrary files on the target system during application.

Why it matters to the business

Attackers can place or modify files in sensitive locations, potentially leading to configuration changes, data tampering, or execution of attacker-controlled code if the patched system is later used.

How an attack unfolds

An attacker crafts a malicious patch file embedding directory traversal sequences or full paths, then tricks a user or automated process into applying it with GNU patch, resulting in files being written outside the intended directory.

How to fix it

Upgrade affected packages to the fixed versions: dive (Chainguard) 0.12.0-r3 or later and dive (Wolfi) 0.12.0-r3 or later. Ensure any embedded or vendored GNU patch instances are also updated to versions after 2.6.1.

How to confirm the fix worked

Verify package versions match or exceed the listed fixed releases, test patch application with known traversal payloads in a controlled environment, and confirm no file writes occur outside the working directory.

Typical attack path

1. Craft malicious patch containing .. sequences or absolute paths
2. Deliver patch to target via email, download, or supply chain
3. Victim or process applies patch using vulnerable GNU patch version
4. Arbitrary files created or overwritten on the system

How to detect it

Examine logs from patch application processes and build systems for unexpected file paths containing dot-dot sequences or absolute paths outside the working directory; review file creation timestamps coinciding with patch operations.

What your security team should do

• Apply the specified fixed package versions immediately
• Scan build and CI pipelines for use of GNU patch and enforce version pinning
• Review historical patch application logs for unexpected file writes