| Vulnerability Name: | CVE-2022-21658 (CCN-217843) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2021-11-16 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2022-01-20 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2022-10-19 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 6.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) 5.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C)
5.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C)
4.6 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 3.3 Low (CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-363 CWE-367 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2022-21658 Source: MISC Type: Exploit, Mitigation, Vendor Advisory https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html Source: XF Type: UNKNOWN rust-cve202221658-sec-bypass(217843) Source: MISC Type: Patch, Third Party Advisory https://github.com/rust-lang/rust/pull/93110 Source: MISC Type: Patch, Third Party Advisory https://github.com/rust-lang/rust/pull/93110/commits/32ed6e599bb4722efefd78bbc9cd7ec4613cb946 Source: MISC Type: Patch, Third Party Advisory https://github.com/rust-lang/rust/pull/93110/commits/406cc071d6cfdfdb678bf3d83d766851de95abaf Source: MISC Type: Patch, Third Party Advisory https://github.com/rust-lang/rust/pull/93110/commits/4f0ad1c92ca08da6e8dc17838070975762f59714 Source: CCN Type: rust GIT Repository Race condition in std::fs::remove_dir_all Source: CONFIRM Type: Exploit, Mitigation, Third Party Advisory https://github.com/rust-lang/rust/security/advisories/GHSA-r9cc-f5pr-p3j2 Source: FEDORA Type: Mailing List, Third Party Advisory FEDORA-2022-06569a0a60 Source: FEDORA Type: Mailing List, Third Party Advisory FEDORA-2022-1bafa3fc91 Source: FEDORA Type: Mailing List, Third Party Advisory FEDORA-2022-2c73789458 Source: FEDORA Type: Mailing List, Third Party Advisory FEDORA-2022-1b76e3a192 Source: CCN Type: oss-sec Mailing List, Thu, 20 Jan 2022 12:02:55 +0100 Race condition in the Rust standard library (CVE-2022-21658) Source: GENTOO Type: Third Party Advisory GLSA-202210-09 Source: CONFIRM Type: Third Party Advisory https://support.apple.com/kb/HT213182 Source: CONFIRM Type: Third Party Advisory https://support.apple.com/kb/HT213183 Source: CONFIRM Type: Third Party Advisory https://support.apple.com/kb/HT213186 Source: CONFIRM Type: Third Party Advisory https://support.apple.com/kb/HT213193 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration RedHat 1: Configuration RedHat 2:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||