Race condition in Rust

Published: 2022-01-21 | Updated: 2022-01-23

Risk	High
Patch available	YES
Number of vulnerabilities	1
CVE-ID	CVE-2022-21658
CWE-ID	CWE-362
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available.
Vulnerable software Subscribe	Rust Programming Language Universal components / Libraries / Programming Languages & Components
Vendor	Rust Team

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Race condition

EUVDB-ID: #VU59898

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-21658

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a race condition in std::fs::remove_dir_all. A remote attacker can exploit the race, escalate privileges and delete arbitrary files on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Rust Programming Language: 1.0.0 - 1.58.0

External links

http://github.com/rust-lang/rust/pull/93110
http://github.com/rust-lang/rust/pull/93110/commits/32ed6e599bb4722efefd78bbc9cd7ec4613cb946
http://github.com/rust-lang/rust/pull/93110/commits/406cc071d6cfdfdb678bf3d83d766851de95abaf
http://blog.rust-lang.org/2022/01/20/cve-2022-21658.html
http://github.com/rust-lang/rust/pull/93110/commits/4f0ad1c92ca08da6e8dc17838070975762f59714
http://github.com/rust-lang/rust/security/advisories/GHSA-r9cc-f5pr-p3j2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.