Insecure Crate Extraction in Cargo (CVE-2023-38497)
Summary
CVE-2023-38497: Cargo downloads the Rust project’s dependencies and compiles the project. Affects rust across 2 version ranges.
< 1.71.1-r0
< d78bbf4bde3c6b95caca7512f537c6f9721426ff
Fixed in 1.71.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cargo is a package manager for the Rust programming language. It is responsible for downloading dependencies and compiling Rust projects. Rust is a systems programming language known for its memory safety and concurrency features. However, Cargo, bundled with Rust, had a vulnerability that allowed local users to exploit the extraction of crate archives on UNIX-like systems. This vulnerability, tracked as CVE-2023-38497, could potentially lead to unauthorized changes in the source code executed by the current user.
Vulnerability Detail
The vulnerability in Cargo (prior to version 0.72.2) arises from the improper handling of file permissions during the extraction of crate archives. Cargo did not respect the umask on UNIX-like systems, which meant that if a user downloaded a crate containing files writable by any local user, another local user could exploit this to modify the source code compiled and executed by the current user. This could lead to unauthorized code execution, privilege escalation, or other malicious activities. The vulnerability was fixed in Cargo version 0.72.2, included in Rust version 1.71.1 or later.
How To Fix
Minimum fixed version
1.71.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade rustTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can configure their systems to restrict access to the Cargo directory, typically located in ~/.cargo. By preventing other local users from accessing this directory, the risk of exploitation can be mitigated. However, this workaround may not be feasible in all scenarios, and it is recommended to apply the official fix by updating Cargo and Rust.
Conclusion
The vulnerability in Cargo (CVE-2023-38497) allowed local users to modify the source code executed by the current user. This could lead to unauthorized code execution and other malicious activities. To mitigate this vulnerability, it is crucial to update Cargo to version 0.72.2 or later, bundled with Rust version 1.71.1 or later. Regularly updating Rust and its associated tools is also recommended. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rust →
FAQ
Cargo is a package manager for the Rust programming language. It handles dependency management and project compilation.
Rust is a systems programming language known for its memory safety and concurrency features. It provides a safer alternative to languages like C and C++.
The vulnerability in Cargo could allow local users to modify the source code executed by the current user. This could lead to unauthorized code execution, privilege escalation, or other malicious activities.
To fix this vulnerability, update Cargo to version 0.72.2 or later, bundled with Rust version 1.71.1 or later. Regularly updating Rust and its associated tools is also recommended.
A workaround is to restrict access to the Cargo directory (~/.cargo) to prevent other local users from exploiting the vulnerability. However, it is recommended to apply the official fix by updating Cargo and Rust.
Related vulnerabilities
Recent vulnerabilities recorded for rust.
