Headline
Red Hat Security Advisory 2023-4634-01
Red Hat Security Advisory 2023-4634-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: rust security update
Advisory ID: RHSA-2023:4634-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:4634
Issue date: 2023-08-14
CVE Names: CVE-2023-38497
=====================================================================
- Summary:
An update for rust is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64
- Description:
Rust Toolset provides the Rust programming language compiler rustc, the
cargo build tool and dependency manager, and required libraries.
Security Fix(es):
- rust-cargo: cargo does not respect the umask when extracting dependencies
(CVE-2023-38497)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2228038 - CVE-2023-38497 rust-cargo: cargo does not respect the umask when extracting dependencies
- Package List:
Red Hat Enterprise Linux AppStream (v. 9):
Source:
rust-1.66.1-2.el9_2.src.rpm
aarch64:
cargo-1.66.1-2.el9_2.aarch64.rpm
cargo-debuginfo-1.66.1-2.el9_2.aarch64.rpm
clippy-1.66.1-2.el9_2.aarch64.rpm
clippy-debuginfo-1.66.1-2.el9_2.aarch64.rpm
rust-1.66.1-2.el9_2.aarch64.rpm
rust-analysis-1.66.1-2.el9_2.aarch64.rpm
rust-analyzer-1.66.1-2.el9_2.aarch64.rpm
rust-analyzer-debuginfo-1.66.1-2.el9_2.aarch64.rpm
rust-debuginfo-1.66.1-2.el9_2.aarch64.rpm
rust-debugsource-1.66.1-2.el9_2.aarch64.rpm
rust-doc-1.66.1-2.el9_2.aarch64.rpm
rust-std-static-1.66.1-2.el9_2.aarch64.rpm
rust-toolset-1.66.1-2.el9_2.aarch64.rpm
rustfmt-1.66.1-2.el9_2.aarch64.rpm
rustfmt-debuginfo-1.66.1-2.el9_2.aarch64.rpm
noarch:
rust-debugger-common-1.66.1-2.el9_2.noarch.rpm
rust-gdb-1.66.1-2.el9_2.noarch.rpm
rust-lldb-1.66.1-2.el9_2.noarch.rpm
rust-src-1.66.1-2.el9_2.noarch.rpm
rust-std-static-wasm32-unknown-unknown-1.66.1-2.el9_2.noarch.rpm
rust-std-static-wasm32-wasi-1.66.1-2.el9_2.noarch.rpm
ppc64le:
cargo-1.66.1-2.el9_2.ppc64le.rpm
cargo-debuginfo-1.66.1-2.el9_2.ppc64le.rpm
clippy-1.66.1-2.el9_2.ppc64le.rpm
clippy-debuginfo-1.66.1-2.el9_2.ppc64le.rpm
rust-1.66.1-2.el9_2.ppc64le.rpm
rust-analysis-1.66.1-2.el9_2.ppc64le.rpm
rust-analyzer-1.66.1-2.el9_2.ppc64le.rpm
rust-analyzer-debuginfo-1.66.1-2.el9_2.ppc64le.rpm
rust-debuginfo-1.66.1-2.el9_2.ppc64le.rpm
rust-debugsource-1.66.1-2.el9_2.ppc64le.rpm
rust-doc-1.66.1-2.el9_2.ppc64le.rpm
rust-std-static-1.66.1-2.el9_2.ppc64le.rpm
rust-toolset-1.66.1-2.el9_2.ppc64le.rpm
rustfmt-1.66.1-2.el9_2.ppc64le.rpm
rustfmt-debuginfo-1.66.1-2.el9_2.ppc64le.rpm
s390x:
cargo-1.66.1-2.el9_2.s390x.rpm
cargo-debuginfo-1.66.1-2.el9_2.s390x.rpm
clippy-1.66.1-2.el9_2.s390x.rpm
clippy-debuginfo-1.66.1-2.el9_2.s390x.rpm
rust-1.66.1-2.el9_2.s390x.rpm
rust-analysis-1.66.1-2.el9_2.s390x.rpm
rust-analyzer-1.66.1-2.el9_2.s390x.rpm
rust-analyzer-debuginfo-1.66.1-2.el9_2.s390x.rpm
rust-debuginfo-1.66.1-2.el9_2.s390x.rpm
rust-debugsource-1.66.1-2.el9_2.s390x.rpm
rust-doc-1.66.1-2.el9_2.s390x.rpm
rust-std-static-1.66.1-2.el9_2.s390x.rpm
rust-toolset-1.66.1-2.el9_2.s390x.rpm
rustfmt-1.66.1-2.el9_2.s390x.rpm
rustfmt-debuginfo-1.66.1-2.el9_2.s390x.rpm
x86_64:
cargo-1.66.1-2.el9_2.x86_64.rpm
cargo-debuginfo-1.66.1-2.el9_2.i686.rpm
cargo-debuginfo-1.66.1-2.el9_2.x86_64.rpm
clippy-1.66.1-2.el9_2.x86_64.rpm
clippy-debuginfo-1.66.1-2.el9_2.i686.rpm
clippy-debuginfo-1.66.1-2.el9_2.x86_64.rpm
rust-1.66.1-2.el9_2.x86_64.rpm
rust-analysis-1.66.1-2.el9_2.x86_64.rpm
rust-analyzer-1.66.1-2.el9_2.x86_64.rpm
rust-analyzer-debuginfo-1.66.1-2.el9_2.i686.rpm
rust-analyzer-debuginfo-1.66.1-2.el9_2.x86_64.rpm
rust-debuginfo-1.66.1-2.el9_2.i686.rpm
rust-debuginfo-1.66.1-2.el9_2.x86_64.rpm
rust-debugsource-1.66.1-2.el9_2.i686.rpm
rust-debugsource-1.66.1-2.el9_2.x86_64.rpm
rust-doc-1.66.1-2.el9_2.x86_64.rpm
rust-std-static-1.66.1-2.el9_2.i686.rpm
rust-std-static-1.66.1-2.el9_2.x86_64.rpm
rust-toolset-1.66.1-2.el9_2.x86_64.rpm
rustfmt-1.66.1-2.el9_2.x86_64.rpm
rustfmt-debuginfo-1.66.1-2.el9_2.i686.rpm
rustfmt-debuginfo-1.66.1-2.el9_2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2023-38497
https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJk2oyDAAoJENzjgjWX9erENoQP/jTfkxW4QnmAoKoj/RfesY37
Z17/QgOELXVroRlDG0QEPxLccxa1M8FOH+uoJtCOypm65WT3BM/+6oCfMJnycee8
aGWuo3KN8aY0P8KO83zFWzjgrJznzqa96JRclSVnSlugZ+SUvCSS/1+J/XLMDUIN
TGhVVwbweep8w1+u05d8OWRlbZcMVkHVJf0WQksVKECxgCuYddDYAGTYRlMohxVm
IPE84HHBFD/iA4Hg89b9c5u6SCLrNj16p/pvn5vldWDEU6Vf31BAH2uAt2d1lGWk
LFWNfbg7tC0/8RGq+xnmtdnpHFaSY1dpHqZiIRgvjKReq35h47esptuIWs1dwaZ6
x9SWXqVHjVz87R1mcFsKhlY7I4l5vEC5lAfjX5fNOnhVbjou9gmmsMsUFpYU+1XV
uJGAGZ/rMbqz/G0FyeCd14qTqZATf86BgKmqcSuHu3zMx2y8+59PqgBhYBGzN3Tu
F2TkuUDD8pNQMsmE7qIzZK3/SGb0DgpMQOScs9fmEubsyeODKDG/2EV8zrF7d2nO
Sr+hQntTAhzB4L+CaFNRNo+rbcbOOidgPK60MOaXux7vwf5Wyahbx9qzghfUBLVc
QnTCU+bhq/u0GIo/SFh6zRoyhfGqdeIv1Ychlkc9CvsKLM9GUhiuFhoHKewqXQL5
L1GELcNRzWCW0SpJXtOn
=RO5t
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Red Hat Security Advisory 2024-3428-03 - An update for the rust-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Security Advisory 2024-3418-03 - An update for rust is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Security Advisory 2023-4651-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.
Red Hat Security Advisory 2023-4635-01 - Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries.
An update for rust-toolset-1.66-rust is now available for Red Hat Developer Tools. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-38497: A flaw was found in the rust-cargo package. Cargo, as bundled with the Rust compiler, did not respect the umask when extracting dependency tarballs and caching the extraction for future builds. If a dependency contained files with 0777 permissions, another local user could edit the cache of the extracted source code, potentially exec...
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.
Ubuntu Security Notice 6275-1 - Addison Crump discovered that Cargo incorrectly set file permissions on UNIX-like systems when extracting crate archives. If the crate would contain files writable by any user, a local attacker could possibly use this issue to execute code as another user.
The Rust Security Response WG was notified that Cargo did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. This vulnerability has been assigned CVE-2023-38497. ## Overview In UNIX-like systems, each file has three sets of permissions: for the user owning the file, for the group owning the file, and for all other local users. The "[umask][1]" is configured on most systems to limit those permissions during file creation, removing dangerous ones. For example, the default umask on macOS and most Linux distributions only allow the user owning a file to write to it, preventing the group owning it or other local users from doing the same. When a dependency is downloaded by Cargo, its source code has to be extracted on disk to allow the Rust compiler to read as part of the build. To ...