{"id":103040,"date":"2022-01-20T21:36:44","date_gmt":"2022-01-20T19:36:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d1%81%d1%82%d0%b0%d0%bd%d0%b4%d0%b0%d1%80%d1%82%d0%bd%d0%be%d0%b9-%d0%b1%d0%b8%d0%b1%d0%bb%d0%b8%d0%be%d1%82%d0%b5%d0%ba%d0%b5"},"modified":"2022-01-20T21:36:44","modified_gmt":"2022-01-20T19:36:44","slug":"%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d1%81%d1%82%d0%b0%d0%bd%d0%b4%d0%b0%d1%80%d1%82%d0%bd%d0%be%d0%b9-%d0%b1%d0%b8%d0%b1%d0%bb%d0%b8%d0%be%d1%82%d0%b5%d0%ba%d0%b5","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d1%81%d1%82%d0%b0%d0%bd%d0%b4%d0%b0%d1%80%d1%82%d0%bd%d0%be%d0%b9-%d0%b1%d0%b8%d0%b1%d0%bb%d0%b8%d0%be%d1%82%d0%b5%d0%ba%d0%b5","title":{"rendered":"Vulnerability in the standard library of the Rust language","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the standard library of the Rust language (CVE-2022-21658), related to a race condition in the std::fs::remove_dir_all() function. When this function is used to delete temporary files in a privileged application, an attacker can achieve the deletion of arbitrary system files and directories that, under normal circumstances, they do not have access to. <\/p>\n
The vulnerability is caused by an incorrect implementation of symbolic link checks before recursively deleting directories. Instead of prohibiting traversal through symbolic links, the remove_dir_all() function first checks if the file is a symbolic link. If it is a link, it is deleted as a file; if it's a directory, the recursive deletion operation for its contents is initiated. The issue is that there is a small delay between the check and the start of the deletion operation. <\/p>\n
At the moment when the check has already been performed, but the operation of traversing directories for deletion has not yet started, an attacker can replace the directory containing temporary files with a symbolic link. If timed correctly, the remove_dir_all() function will treat the symbolic link as a directory and begin to delete the contents pointed to by this link. Although the success of the attack depends on the precision of the timing of the directory replacement, and hitting the right moment on the first try is unlikely, researchers have managed to achieve repeatable success in carrying out the attack within seconds after executing the exploit. <\/p>\n
All versions of Rust from 1.0.0 to 1.58.0 inclusive are affected by this vulnerability. A patch has been released to address the issue (the fix will be included in version 1.58.1, which is expected within a few hours). The vulnerability fix can be tracked in the distributions on the following pages: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch, FreeBSD. All users of Rust programs running with elevated privileges and using the remove_dir_all function are advised to urgently update Rust to version 1.58.1. Interestingly, the released patch does not resolve the issue on all systems; for example, on REDOX OS and versions of macOS prior to 10.10 (Yosemite), the vulnerability is not blocked due to the lack of the O_NOFOLLOW flag, which disables following symbolic links. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"