Kusagadzikana (CVE-2022-21658) kwaonekwa muRust standard raibhurari nekuda kwechimiro chemujaho mu std::fs::remove_dir_all() basa. Kana basa iri rikashandiswa kudzima mafaira enguva pfupi mune yakasarudzika application, munhu anorwisa anogona kuwana kudzima kwemafaira ehurongwa hwemafaira nemadhairekitori ayo munhu anorwisa aisazokwanisa kudzima.
Kusagadzikana uku kunokonzerwa nekuitwa zvisirizvo kwekutarisa malink echiratidzo usati wadzimazve madhairekitori. Panzvimbo pekudzivirira symlinks kubva pakuteverwa, bvisa_dir_all() tanga watarisa kana faira iri symlink. Kana chinongedzo chikatsanangurwa, chobva chadzimwa sefaira, uye kana iri dhairekitori, ipapo inodzokororwa yekubvisa zvirimo inodanwa. Dambudziko nderekuti pane kunonoka kushoma pakati pecheki uye kutanga kwekudzima.
Pane imwe nguva iyo cheki yakatoitwa, asi kushanda kwekunyora madhairekitori ekudzima kusati kwatanga, anorwisa anogona kutsiva dhairekitori nemafaira echinguvana ane chinongedzo chekufananidzira. Kana ikarova panguva yakakodzera, iyo remove_dir_all () basa rinobata chinongedzo chinongedzo sedhairekitori uye tanga kubvisa izvo zvinonongedza chinongedzo. Kunyangwe chokwadi chekuti kubudirira kwekurwiswa kunoenderana nekurongeka kwenguva yakasarudzwa yekutsiva dhairekitori uye kurova iyo chaiyo nguva yekutanga isingagoneke, panguva yekuedza vaongorori vakakwanisa kuwana kudzokorora kwakabudirira kurwisa mushure mekuita basa mukati. masekonzi mashoma.
Yese shanduro dzeRust kubva ku1.0.0 kusvika 1.58.0 inosanganisirwa inobatwa. Nyaya yacho yakagadziriswa mufomu yechigamba ikozvino (kugadzirisa kuchabatanidzwa mukubudiswa kwe1.58.1, iyo inotarisirwa mukati maawa mashomanana). Unogona kutarisa kubviswa kwekusagadzikana mukugoverwa pamapeji aya: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch, FreeBSD. Vese vashandisi veRust zvirongwa zvinomhanya neropafadzo dzakakwirira uye vachishandisa iyo remove_dir_all basa vanorairwa kukurumidza kugadzirisa Rust kune vhezheni 1.58.1. Zvinonakidza kuti chigamba chakaburitswa hachigadzirise dambudziko pane ese masisitimu; semuenzaniso, muREDOX OS uye macOS macOS isati yasvika 10.10 (Yosemite), kusagadzikana hakuna kuvharwa nekuda kwekushaikwa kwemureza weO_NOFOLLOW, unodzima kutevera kwekufananidzira. links.
Source: opennet.ru