A Rust programming bug could delete files and directories

A Rust programming bug could delete files and directories

Short News:-

The maintainers of the Rust programming language have released a security update for a high-severity vulnerability. The issue stems from an improperly implemented check to prevent recursive deletion of symbolic links. This could be reliably exploited by an adversary by abusing access to a privileged program.

Detailed News:-

In response to a critical vulnerability in the Rust programming language, the language's developers have released a security update that addresses the threat of unauthorized deletion of files and directories on a vulnerable system.

Rust's Security Response Working Group (WG) said in an advisory published on January 20, 2021, "An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete."

This flaw affects versions 1.0.0 through 1.58.0 of the Rust programming language. Security researcher Hans Kratz is to blame for the vulnerability, which has been tracked as CVE-2022-21658 (CVSS score: 7.3) and fixed in Rust version 1.58.1, which was released last week.

This is a result of an error in a standard library function called "std::fs::remove dir all," which attempts to prevent the recursive deletion of symbolic links (also known as symlinks). This creates a race condition that an adversary could exploit to delete sensitive directories by abusing their privileges in a privileged program.

Because the standard library didn't explicitly say not to delete symlinks, the advisory explained that it first checked to see if the file or directory it was about to remove was one, before deleting everything in the parent directory. During the time between the check and the actual deletion, an attacker could create a directory and then replace it with a symlink."

As a programming language that isn't widely used, Rust saw a recent surge of adoption for its memory-related guarantees. As Google announced last year, Android's open-source version will include support for the programming language to help guard against bugs that affect memory safety.