Alerts This Week
Warning Icon 1 770
Alerts This Week
Warning Icon 1 770

Mageia 8 MGASA-2022-0044 Critical: Rust Symlink Race Condition

mageia
Calendar Grey February 2, 2022
Dist Mageia Esm H88
An enhancement to the Rust component in Mageia 8 has resolved a race condition flaw, thereby bolstering the system's security measures.
This update provides Rust 1.57.0 as a feature and bugfix update

Summary

This update provides Rust 1.57.0 as a feature and bugfix update. See the release notes for details.
The 'std::fs::remove_dir_all' standard library function was vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete (CVE-2022-21658). This vulnerability was fixed by patching Rust 1.57.0.

References

- https://bugs.mageia.org/show_bug.cgi?id=29912

- https://blog.rust-lang.org/2021/12/02/Rust-1.57.0.html

- https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html

- https://www.cve.org/CVERecord?id=CVE-2022-21658

Topics%20covered

Topics Covered

security advisory update critical symlink issue mageia rust

Resolution

SRPMS

- 8/core/rust-1.57.0-1.1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 02 Feb 2022
URL: https://advisories.mageia.org/MGASA-2022-0044.html
Type: security
CVE: CVE-2022-21658

Topics%20covered

Topics Covered

security advisory update critical symlink issue mageia rust

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here