A vulnerability has been identified in the standard library of the Rust language (CVE-2022-21658), related to a race condition in the std::fs::remove_dir_all() function. When this function is used to delete temporary files in a privileged application, an attacker can achieve the deletion of arbitrary system files and directories that, under normal circumstances, they do not have access to.
The vulnerability is caused by an improper implementation of the symbolic link check before recursively deleting directories. Instead of prohibiting the following of symbolic links, the remove_dir_all() function first checks whether the file is a symbolic link. If a link is found, it is removed as a file, and if it is a directory, the recursive deletion of contents is initiated. The issue lies in the small delay between the check and the start of the deletion operation.
At the moment when the check has already been performed, but the operation of traversing directories for deletion has not yet started, an attacker can replace the directory containing temporary files with a symbolic link. If timed correctly, the remove_dir_all() function will treat the symbolic link as a directory and begin to delete the contents pointed to by this link. Although the success of the attack depends on the precision of the timing of the directory replacement, and hitting the right moment on the first try is unlikely, researchers have managed to achieve repeatable success in carrying out the attack within seconds after executing the exploit.
All versions of Rust from 1.0.0 to 1.58.0 inclusive are affected by this vulnerability. A patch has been released to address the issue (the fix will be included in version 1.58.1, which is expected within a few hours). The vulnerability fix can be tracked in the distributions on the following pages: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch, FreeBSD. All users of Rust programs running with elevated privileges and using the remove_dir_all function are advised to urgently update Rust to version 1.58.1. Interestingly, the released patch does not resolve the issue on all systems; for example, on REDOX OS and versions of macOS prior to 10.10 (Yosemite), the vulnerability is not blocked due to the lack of the O_NOFOLLOW flag, which disables following symbolic links.
Source: opennet.ru
