The Cargo package manager, used for managing packages and building projects in Rust, has been found to have two vulnerabilities that could be exploited when downloading specially crafted packages from third-party repositories (it is claimed that users of the official crates.io repository are not affected by this issue). The first vulnerability (CVE-2022-36113) allows overwriting the first two bytes of any file, depending on the current permissions. The second vulnerability (CVE-2022-36114) could be used to exhaust available disk space.
The vulnerabilities will be addressed in the Rust 1.64 release scheduled for September 22. They have been assigned a low severity level, as similar damage when using unverified packages from third-party repositories can be caused by the default ability to run custom handlers from the included build scripts or procedural macros. In this case, the above-mentioned issues differ in that their exploitation occurs during the package unpacking stage after downloading (without building).
Specifically, after downloading a package, Cargo extracts its contents to the ~/cargo directory and saves the indicator of successful extraction in the .cargo-ok file. The essence of the first vulnerability is that the package creator can place a symbolic link named .cargo-ok inside, leading to the text "ok" being written to the file pointed to by the link.
The second vulnerability arises from the lack of a limit on the size of data extracted from the archive, which can be leveraged to create "zip bombs" (an archive may contain data allowing for the maximum compression degree for the zip format — about 28 million times; in this case, for example, a specially prepared 10 MB zip file could result in the extraction of about 281 TB of data).
Source: opennet.ru
