Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-21658: A race condition flaw was found in Rust's std::fs::remove_dir_all function. Rust applications that use this function may be vulnerable to a race condition where an unprivileged attacker can trick the application into deleting files and directories, causing an impact on system data integrity. If the application is privileged, an attacker can possibly delete files they would not usually have access to.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | cargo | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | cargo-doc | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | clippy | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | rls | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | rust | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | rust-analysis | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | rust-debugger-common | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | rust-debuginfo | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | rust-doc | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | rust-gdb | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | rust-src | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | rust-std-static | 0:1.61.0-2.amzn2.0.1 |
| Amazon Linux · 2 | rustfmt | 0:1.61.0-2.amzn2.0.1 |
Vulnerabilities 1
-
High 7.3CVE-2022-21658 Public exploit
Race condition in std::fs::remove_dir_all in rustlang
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condi…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-21658.html