Skip to content
OpenAdvisories
High · 7.8 Public exploit CVE-2023-38497 EUVD-2023-2308GHSA-j3xp-wfr4-hx87

Cargo not respecting umask when extracting crate archives

Published Aug 4, 2023 · Updated Feb 13, 2025 · Assigned by GitHub_M

Vendor: rust-lang Product: cargo Package: cargo Package: cargo Package: cargo Package: chromium-rust Package: rust Package: rust Package: rust-cargo Package: rust-cargo Package: rustc Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: crates.io Ecosystem: Debian Ecosystem: Ubuntu

Description

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.

Affected products

VendorProductAffectedFixed
rust-lang cargo < 0.72.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rust-cargo 0.76.0-1 —
Debian 13 rust-cargo 0.76.0-1 —
Debian 12 cargo +1 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS rust-cargo No fix yet —
Ubuntu 24.04 LTS rustc 1.71.1+dfsg0ubuntu2-0ubuntu1 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS cargo 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2+esm1 USN-6275-1
Ubuntu Pro 22.04 LTS rust-cargo 0.57.0-1ubuntu0.1~esm1 USN-6275-1
Ubuntu Pro 20.04 LTS cargo 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2+esm1 USN-6275-1
Ubuntu Pro 18.04 LTS cargo 0.66.0+ds0ubuntu0.libgit2-0ubuntu0.18.04.1~esm1 USN-6275-1
Ubuntu Pro 16.04 LTS cargo 0.47.0-1~exp1ubuntu1~16.04.1+esm1 USN-6275-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 rust +14 1.66.1-2.el9_2 RHSA-2023:4634
RHEL 8 rust +14 1.66.1-2.module+el8.8.0+19613+f0bba33b RHSA-2023:4635
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.0 EUS rls +14 1.58.1-1.el9_0.1 RHSA-2024:3418
RHEL 8.6 EUS rls +14 1.58.1-1.module+el8.6.0+21522+a4bc17c1.1 RHSA-2024:3428
RHEL 8.6 EUS rust-toolset 1.58.1-1.module+el8.6.0+14021+586eff1a RHSA-2024:3428
Red Hat Devtools 2023 rust-toolset-1.66-rust +11 1.66.1-2.el7_9 RHSA-2023:4651

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 rust +14 1.66.1-2.el9_2 ALSA-2023:4634
AlmaLinux 8 rust +14 1.66.1-2.module_el8.8.0+3604+b9bee1fc ALSA-2023:4635

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 rust 1.66.1-2.el9_2 RLSA-2023:4634
Rocky Linux 8 rust 1.66.1-2.module+el8.8.0+1428+0690fcea RLSA-2023:4635

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 rust1.71 1.71.1-150400.9.6.1 SUSE-SU-2023:3251-1
SLES 15 SP4 rust1.71 1.71.1-150400.9.6.1 SUSE-SU-2023:3251-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rust1.71 1.71.1-1.1 openSUSE-SU-2024:13101-1
openSUSE Leap 15.5 rust1.71 1.71.1-150400.9.6.1 SUSE-SU-2023:3251-1
openSUSE Leap 15.4 rust1.71 1.71.1-150400.9.6.1 SUSE-SU-2023:3251-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 rust +1 1.71.1-r0 —
Alpine v3.23 rust 1.71.1-r0 —
Alpine v3.22 rust 1.71.1-r0 —
Alpine v3.21 rust 1.71.1-r0 —
Alpine v3.20 rust 1.71.1-r0 —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 rust 1.71.1-r0 —
Alpine v3.18 rust 1.71.1-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 rust +13 1.68.2-1.amzn2023.0.2 ALAS2023-2023-323
Amazon Linux 2 rust +11 1.68.2-1.amzn2.0.3 ALAS2-2023-2223

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) rust 1.72.0-2 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 rust +14 1.66.1-2.el9_2 ELSA-2023-4634
Oracle Linux 8 rust +14 1.66.1-2.module+el8.8.0+21152+49720d82 ELSA-2023-4635

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io cargo < 0.72.2 0.72.2 GHSA-j3xp-wfr4-hx87

Advisories 17

References