is public

From: Pietro Albini <pietro@pietroalbini.org>
Subject: [oss-security] Race condition in the Rust standard library (CVE-2022-21658)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

The Rust Security Response WG was notified that the `std::fs::remove_dir_all`
standard library function is vulneable a race condition enabling symlink
following (CWE-363). An attacker could use this security issue to trick a
privileged program into deleting files and directories the attacker couldn't
otherwise access or delete.

This issue has been assigned [CVE-2022-21658][1].

## Overview

Let's suppose an attacker obtained unprivileged access to a system and needed
to delete a system directory called `sensitive/`, but they didn't have the
permissions to do so. If `std::fs::remove_dir_all` followed symbolic links,
they could find a privileged program that removes a directory they have access
to (called `temp/`), create a symlink from `temp/foo` to `sensitive/`, and wait
for the privileged program to delete `foo/`. The privileged program would
follow the symlink from `temp/foo` to `sensitive/` while recursively deleting,
resulting in `sensitive/` being deleted.

To prevent such attacks, `std::fs::remove_dir_all` already includes protection
to avoid recursively deleting symlinks, as described in its documentation:

 > This function does **not** follow symbolic links and it will simply remove
 > the symbolic link itself.

Unfortunately that check was implemented incorrectly in the standard library,
resulting in a TOCTOU (Time-of-check Time-of-use) race condition. Instead of
telling the system not to follow symlinks, the standard library first checked
whether the thing it was about to delete was a symlink, and otherwise it would
proceed to recursively delete the directory.

This exposed a race condition: an attacker could create a directory and replace
it with a symlink between the check and the actual deletion. While this attack
likely won't work the first time it's attempted, in our experimentation we were
able to reliably perform it within a couple of seconds.

## Affected Versions

Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability. We're going
to release Rust 1.58.1 later today, which will include mitigations for this
vulnerability. Patches to the Rust standard library are also available for
custom-built Rust toolchains [2].

Note that the following targets don't have usable APIs to properly mitigate the
attack, and are thus still vulnerable even with a patched toolchain:
* macOS before version 10.10 (Yosemite)
* REDOX

## Mitigations

We recommend everyone to update to Rust 1.58.1 as soon as possible, especially
people developing programs expected to run in privileged contexts (including
system daemons and setuid binaries), as those have the highest risk of being
affected by this.

Note that adding checks in your codebase before calling `remove_dir_all` will
**not** mitigate the vulnerability, as they would also be vulnerable to race
conditions like `remove_dir_all` itself. The existing mitigation is working as
intended outside of race conditions.

## Acknowledgments

We want to thank Hans Kratz for independently discovering and disclosing this
issue to us according to the [Rust security policy][3], for developing the fix
for UNIX-like targets and for reviewing fixes for other platforms.

We also want to thank Florian Weimer for reviewing the UNIX-like fix and for
reporting the same issue back in 2018, even though the Security Response WG
didn't realize the severity of the issue at the time.

Finally we want to thank Pietro Albini for coordinating the security response
and writing this advisory, Chris Denton for writing the Windows fix, Alex
Crichton for writing the WASI fix, and Mara Bos for reviewing the patches.

[1]: https://www.cve.org/CVERecord?id=CVE-2022-21658
[2]: https://github.com/rust-lang/wg-security-response/tree/master/patches/CVE-2022-21658
[3]: https://www.rust-lang.org/policies/security

Assigning to security team since all the SR's are done.

SUSE-SU-2022:0149-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    rust1.56-1.56.1-150300.7.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

openSUSE-SU-2022:0149-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    rust1.56-1.56.1-150300.7.6.1

openSUSE-SU-2022:0175-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    rust1.57-1.57.0-150300.7.7.1

openSUSE-SU-2022:0171-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    rust1.55-1.55.0-150300.7.6.1

SUSE-SU-2022:0175-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    rust1.57-1.57.0-150300.7.7.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2022:0171-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    rust1.55-1.55.0-150300.7.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2022:0200-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    rust-1.53.0-3.40.1
SUSE Linux Enterprise Server 15-LTSS (src):    rust-1.53.0-3.40.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    rust-1.53.0-3.40.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    rust-1.53.0-3.40.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2022:0491-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    rust-1.53.0-22.1
SUSE Manager Retail Branch Server 4.1 (src):    rust-1.53.0-22.1
SUSE Manager Proxy 4.1 (src):    rust-1.53.0-22.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    rust-1.53.0-22.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    rust-1.53.0-22.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    rust-1.53.0-22.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    rust-1.53.0-22.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    rust-1.53.0-22.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    rust-1.53.0-22.1
SUSE Linux Enterprise Realtime Extension 15-SP2 (src):    rust-1.53.0-22.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    rust-1.53.0-22.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    rust-1.53.0-22.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    rust-1.53.0-22.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    rust-1.53.0-22.1
SUSE Enterprise Storage 7 (src):    rust-1.53.0-22.1
SUSE Enterprise Storage 6 (src):    rust-1.53.0-22.1
SUSE CaaS Platform 4.0 (src):    rust-1.53.0-22.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

openSUSE-SU-2022:0491-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    rust-1.53.0-22.1
openSUSE Leap 15.3 (src):    rust-1.53.0-22.1

SUSE-SU-2022:0843-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    rust-1.59.0-150300.21.20.1, rust1.58-1.58.0-150300.7.3.1, rust1.59-1.59.0-150300.7.4.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

openSUSE-SU-2022:0843-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1194767
CVE References: CVE-2022-21658
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    rust-1.59.0-150300.21.20.1
openSUSE Leap 15.3 (src):    rust-1.59.0-150300.21.20.1, rust1.58-1.58.0-150300.7.3.1, rust1.59-1.59.0-150300.7.4.2

openSUSE-SU-2022:0149-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1193372,1194767
CVE References: CVE-2021-28237,CVE-2022-21658
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    rust1.56-1.56.1-150300.7.6.1
openSUSE Backports SLE-15-SP3 (src):    libredwg-0.12.5-bp153.2.3.1