N\u00eb bibliotek\u00ebn standarde t\u00eb gjuh\u00ebs Rust \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi (CVE-2022-21658), e lidhur me nj\u00eb race condition n\u00eb funksionin std::fs::remove_dir_all(). N\u00ebse ky funksion p\u00ebrdoret p\u00ebr t\u00eb fshir\u00eb skedar\u00eb t\u00eb p\u00ebrkohsh\u00ebm n\u00eb nj\u00eb aplikacion me privilegje, nj\u00eb sulmues mund t\u00eb arrij\u00eb t\u00eb fshij\u00eb skedar\u00eb dhe direktoriume arbitrare t\u00eb sistemit, t\u00eb cilat n\u00eb kushte normale nuk i ka t\u00eb aksesueshme p\u00ebr fshirje. <\/p>\n
Vulnerabiliteti shkaktohet nga realizimi i pasakt\u00eb i kontrollit t\u00eb lidhjeve simbolike para fshirjes s\u00eb recursion t\u00eb katalog\u00ebve. N\u00eb vend q\u00eb t\u00eb ndalonte ndjekjen e lidhjeve simbolike, funksioni remove_dir_all() fillimisht kontrollon n\u00ebse skedari \u00ebsht\u00eb nj\u00eb lidhje simbolike. N\u00ebse identifikohet nj\u00eb lidhje, ajo fshihet si skedar, nd\u00ebrsa n\u00ebse \u00ebsht\u00eb nj\u00eb katalog - kryhet operacioni i fshirjes recursive t\u00eb p\u00ebrmbajtjes. Problemi \u00ebsht\u00eb se midis kontrollit dhe fillimit t\u00eb operacionit t\u00eb fshirjes ka nj\u00eb vones\u00eb t\u00eb vog\u00ebl. <\/p>\n
N\u00eb momentin kur kontrolli \u00ebsht\u00eb kryer tashm\u00eb, por operacioni i p\u00ebrshkimit t\u00eb direktoriumeve p\u00ebr fshirje ende nuk ka nisur, sulmuesi mund ta z\u00ebvend\u00ebsoj\u00eb direktoriumin me skedar\u00eb t\u00eb p\u00ebrkohsh\u00ebm me nj\u00eb lidhje simbolike. N\u00ebse veprimi kryhet n\u00eb momentin e duhur, funksioni remove_dir_all() do ta trajtoj\u00eb lidhjen simbolike si direktorium dhe do t\u00eb nis\u00eb fshirjen e p\u00ebrmbajtjes ku ajo lidhje referon. Edhe pse suksesi i sulmit varet nga sakt\u00ebsia e koh\u00ebs s\u00eb zgjedhur p\u00ebr z\u00ebvend\u00ebsimin e direktoriumit dhe goditja e sakt\u00eb q\u00eb n\u00eb p\u00ebrpjekjen e par\u00eb \u00ebsht\u00eb pak e mundshme, gjat\u00eb eksperimenteve studiuesit arrit\u00ebn t\u00eb siguronin nj\u00eb kryerje t\u00eb p\u00ebrs\u00ebritshme dhe t\u00eb suksesshme t\u00eb sulmit pas ekzekutimit t\u00eb eksploitit p\u00ebr disa sekonda. <\/p>\n
T\u00eb gjitha versionet e Rust nga 1.0.0 deri te 1.58.0, p\u00ebrfshir\u00eb, preken nga kjo cenueshm\u00ebri. Problemi deri tani \u00ebsht\u00eb rregulluar n\u00eb form\u00ebn e nj\u00eb patch-i (rregullimi do t\u00eb p\u00ebrfshihet n\u00eb versionin 1.58.1, q\u00eb pritet brenda disa or\u00ebsh). Ecuria e eliminimit t\u00eb cenueshm\u00ebris\u00eb n\u00eb distributime mund t\u00eb ndiqet n\u00eb k\u00ebto faqe: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch, FreeBSD. T\u00eb gjith\u00eb p\u00ebrdoruesit e programeve t\u00eb shkruara n\u00eb Rust, q\u00eb ekzekutohen me privilegje t\u00eb ngritura dhe p\u00ebrdorin funksionin remove_dir_all, k\u00ebshillohen t\u00eb p\u00ebrdit\u00ebsojn\u00eb urgjentisht Rust n\u00eb versionin 1.58.1. Vlen t\u00eb theksohet se patch-i i publikuar nuk e zgjidh problemin n\u00eb t\u00eb gjitha sistemet; p\u00ebr shembull, n\u00eb OS REDOX dhe n\u00eb versionet e macOS para 10.10 (Yosemite), cenueshm\u00ebria nuk bllokohet p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb flamurit O_NOFOLLOW, i cili \u00e7aktivizon ndjekjen e lidhjeve simbolike. \u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u044f\u0437\u044b\u043a\u0430 Rust \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-21658), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c \u0433\u043e\u043d\u043a\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 std::fs::remove_dir_all(). \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432, \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0441\u0441\u044b\u043b\u043e\u043a \u043f\u0435\u0440\u0435\u0434 \u0440\u0435\u043a\u0443\u0440\u0441\u0438\u0432\u043d\u044b\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103040","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cenueshm\u00ebri n\u00eb bibliotek\u00ebn standarde t\u00eb gjuh\u00ebs Rust | ProHoster","description":"N\u00eb bibliotek\u00ebn standarde t\u00eb gjuh\u00ebs Rust \u00ebsht\u00eb zbuluar nj\u00eb cenueshm\u00ebri (CVE-2022-21658), e lidhur me nj\u00eb race condition n\u00eb funksionin std::fs::remove_dir_all().","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d1%81%d1%82%d0%b0%d0%bd%d0%b4%d0%b0%d1%80%d1%82%d0%bd%d0%be%d0%b9-%d0%b1%d0%b8%d0%b1%d0%bb%d0%b8%d0%be%d1%82%d0%b5%d0%ba%d0%b5","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u044f\u0437\u044b\u043a\u0430 Rust | ProHoster","og:description":"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u044f\u0437\u044b\u043a\u0430 Rust \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-21658), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c \u0433\u043e\u043d\u043a\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 std::fs::remove_dir_all().","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d1%8c-%d0%b2-%d1%81%d1%82%d0%b0%d0%bd%d0%b4%d0%b0%d1%80%d1%82%d0%bd%d0%be%d0%b9-%d0%b1%d0%b8%d0%b1%d0%bb%d0%b8%d0%be%d1%82%d0%b5%d0%ba%d0%b5","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-01-20T19:36:44+00:00","article:modified_time":"2022-01-20T19:36:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103040","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-01-20 19:37:46","updated":"2022-09-27 19:34:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/103040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=103040"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/103040\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=103040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=103040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=103040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"