CVE-2022-21658

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::remove_dir_all standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.

Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

The following packages have been upgraded to a later upstream version: rust (1.58.0). (BZ#2002883)

Security Fix(es):

• rust: Race condition in remove_dir_all leading to removal of files outside of the directory being removed (CVE-2022-21658)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the std::fs::remove_dir_all standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.

Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.

The following packages have been upgraded to a later upstream version: rust (1.58.0). (BZ#2002883)

Security Fix(es):

• rust: Race condition in remove_dir_all leading to removal of files outside of the directory being removed (CVE-2022-21658)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update provides Rust 1.57.0 as a feature and bugfix update. See the release notes for details.

The 'std::fs::remove_dir_all' standard library function was vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete (CVE-2022-21658). This vulnerability was fixed by patching Rust 1.57.0.

This update for rust1.56 fixes the following issues:

• CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).

This update for rust1.55 fixes the following issues:

• CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).

This update for rust1.57 fixes the following issues:

• CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).

This update for rust fixes the following issues:

• CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).

This update for rust, rust1.58, rust1.59 fixes the following issues:

This update provides both rust1.58 and rust1.59.

Changes in rust1.58:

• Add recommends for GCC for installs to be able to link.
• Add suggests for lld/clang which are faster than gcc for linking to allow users choice on what they use.
• CVE-2022-21658: Resolve race condition in std::fs::remove_dir_all (bsc#1194767)

Version 1.58.0 (2022-01-13)

Language

• [Format strings can now capture arguments simply by writing {ident} in the string.][90473] This works in all macros accepting format strings. Support for this in panic! (panic!('{ident}')) requires the 2021 edition; panic invocations in previous editions that appear to be trying to use this will result in a warning lint about not having the intended effect.
• [*const T pointers can now be dereferenced in const contexts.][89551]
• [The rules for when a generic struct implements Unsize have been relaxed.][90417] Compiler

• [Add LLVM CFI support to the Rust compiler][89652]
• [Stabilize -Z strip as -C strip][90058]. Note that while release builds already don't add debug symbols for the code you compile, the compiled standard library that ships with Rust includes debug symbols, so you may want to use the strip option to remove these symbols to produce smaller release binaries. Note that this release only includes support in rustc, not directly in cargo.
• [Add support for LLVM coverage mapping format versions 5 and 6][91207]
• [Emit LLVM optimization remarks when enabled with -Cremark][90833]
• [Update the minimum external LLVM to 12][90175]
• [Add x86_64-unknown-none at Tier 3*][89062]
• [Build musl dist artifacts with debuginfo enabled][90733]. When building release binaries using musl, you may want to use the newly stabilized strip option to remove these debug symbols, reducing the size of your binaries.
• [Don't abort compilation after giving a lint error][87337]
• [Error messages point at the source of trait bound obligations in more places][89580] * Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support.

Libraries

• [All remaining functions in the standard library have #[must_use] annotations where appropriate][89692], producing a warning when ignoring their return value. This helps catch mistakes such as expecting a function to mutate a value in place rather than return a new value.
• [Paths are automatically canonicalized on Windows for operations that support it][89174]
• [Re-enable debug checks for copy and copy_nonoverlapping][90041]
• [Implement RefUnwindSafe for Rc<T>][87467]
• [Make RSplit<T, P>: Clone not require T: Clone][90117]
• [Implement Termination for Result<Infallible, E>][88601]. This allows writing fn main() -> Result<Infallible, ErrorType>, for a program whose successful exits never involve returning from main (for instance, a program that calls exit, or that uses exec to run another program).

Stabilized APIs

• [Metadata::is_symlink]
• [Path::is_symlink]
• [{integer}::saturating_div]
• [Option::unwrap_unchecked]
• [Result::unwrap_unchecked]
• [Result::unwrap_err_unchecked]
• [NonZero{unsigned}::is_power_of_two]
• [File::options] These APIs are now usable in const contexts:
• [Duration::new]
• [Duration::checked_add]
• [Duration::saturating_add]
• [Duration::checked_sub]
• [Duration::saturating_sub]
• [Duration::checked_mul]
• [Duration::saturating_mul]
• [Duration::checked_div]
• [MaybeUninit::as_ptr]
• [MaybeUninit::as_mut_ptr]
• [MaybeUninit::assume_init]
• [MaybeUninit::assume_init_ref]

Cargo

• [Add --message-format for install command][cargo/10107]
• [Warn when alias shadows external subcommand][cargo/10082]

Rustdoc

• [Show all Deref implementations recursively in rustdoc][90183]
• [Use computed visibility in rustdoc][88447]

Compatibility…

These are all security issues fixed in the cargo1.56-1.56.1-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo1.57-1.57.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo1.58-1.58.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for rust1.56 fixes the following issues:

• CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).

This update for rust1.55 fixes the following issues:

• CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).

This update for rust1.57 fixes the following issues:

• CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).

This update for rust fixes the following issues:

• CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).

This update for rust fixes the following issues:

• CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767).

This update for rust, rust1.58, rust1.59 fixes the following issues:

This update provides both rust1.58 and rust1.59.

Changes in rust1.58:

• Add recommends for GCC for installs to be able to link.
• Add suggests for lld/clang which are faster than gcc for linking to allow users choice on what they use.
• CVE-2022-21658: Resolve race condition in std::fs::remove_dir_all (bsc#1194767)

Version 1.58.0 (2022-01-13)

Language

• [Format strings can now capture arguments simply by writing {ident} in the string.][90473] This works in all macros accepting format strings. Support for this in panic! (panic!('{ident}')) requires the 2021 edition; panic invocations in previous editions that appear to be trying to use this will result in a warning lint about not having the intended effect.
• [*const T pointers can now be dereferenced in const contexts.][89551]
• [The rules for when a generic struct implements Unsize have been relaxed.][90417] Compiler

• [Add LLVM CFI support to the Rust compiler][89652]
• [Stabilize -Z strip as -C strip][90058]. Note that while release builds already don't add debug symbols for the code you compile, the compiled standard library that ships with Rust includes debug symbols, so you may want to use the strip option to remove these symbols to produce smaller release binaries. Note that this release only includes support in rustc, not directly in cargo.
• [Add support for LLVM coverage mapping format versions 5 and 6][91207]
• [Emit LLVM optimization remarks when enabled with -Cremark][90833]
• [Update the minimum external LLVM to 12][90175]
• [Add x86_64-unknown-none at Tier 3*][89062]
• [Build musl dist artifacts with debuginfo enabled][90733]. When building release binaries using musl, you may want to use the newly stabilized strip option to remove these debug symbols, reducing the size of your binaries.
• [Don't abort compilation after giving a lint error][87337]
• [Error messages point at the source of trait bound obligations in more places][89580] * Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support.

Libraries

• [All remaining functions in the standard library have #[must_use] annotations where appropriate][89692], producing a warning when ignoring their return value. This helps catch mistakes such as expecting a function to mutate a value in place rather than return a new value.
• [Paths are automatically canonicalized on Windows for operations that support it][89174]
• [Re-enable debug checks for copy and copy_nonoverlapping][90041]
• [Implement RefUnwindSafe for Rc<T>][87467]
• [Make RSplit<T, P>: Clone not require T: Clone][90117]
• [Implement Termination for Result<Infallible, E>][88601]. This allows writing fn main() -> Result<Infallible, ErrorType>, for a program whose successful exits never involve returning from main (for instance, a program that calls exit, or that uses exec to run another program).

Stabilized APIs

• [Metadata::is_symlink]
• [Path::is_symlink]
• [{integer}::saturating_div]
• [Option::unwrap_unchecked]
• [Result::unwrap_unchecked]
• [Result::unwrap_err_unchecked]
• [NonZero{unsigned}::is_power_of_two]
• [File::options] These APIs are now usable in const contexts:
• [Duration::new]
• [Duration::checked_add]
• [Duration::saturating_add]
• [Duration::checked_sub]
• [Duration::saturating_sub]
• [Duration::checked_mul]
• [Duration::saturating_mul]
• [Duration::checked_div]
• [MaybeUninit::as_ptr]
• [MaybeUninit::as_mut_ptr]
• [MaybeUninit::assume_init]
• [MaybeUninit::assume_init_ref]

Cargo

• [Add --message-format for install command][cargo/10107]
• [Warn when alias shadows external subcommand][cargo/10082]

Rustdoc

• [Show all Deref implementations recursively in rustdoc][90183]
• [Use computed visibility in rustdoc][88447]

Compatibility…