openEuler 22.03 LTS SP1 update for rust

Published: 2024-07-05

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-36113 CVE-2022-36114
CWE-ID	CWE-61 CWE-400
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	openEuler Operating systems & Components / Operating system rust-src Operating systems & Components / Operating system package or component rust-lldb Operating systems & Components / Operating system package or component rust-gdb Operating systems & Components / Operating system package or component rust-debugger-common Operating systems & Components / Operating system package or component rustfmt Operating systems & Components / Operating system package or component rust-std-static Operating systems & Components / Operating system package or component rust-help Operating systems & Components / Operating system package or component rust-debugsource Operating systems & Components / Operating system package or component rust-debuginfo Operating systems & Components / Operating system package or component rust-analysis Operating systems & Components / Operating system package or component rls Operating systems & Components / Operating system package or component clippy Operating systems & Components / Operating system package or component cargo Operating systems & Components / Operating system package or component rust Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) UNIX symbolic link following

EUVDB-ID: #VU67717

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-36113

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

Exploit availability: No

Description

The vulnerability allows a remote attacker to corrupt arbitrary files on the system.

The vulnerability exists due to a symlink following issue. A remote attacker can add a malicious ".cargo-ok" symbolic link into the package, point the link to an arbitrary file on the system and corrupt it during package extraction.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 22.03 LTS SP1

rust-src: before 1.60.0-4

rust-lldb: before 1.60.0-4

rust-gdb: before 1.60.0-4

rust-debugger-common: before 1.60.0-4

rustfmt: before 1.60.0-4

rust-std-static: before 1.60.0-4

rust-help: before 1.60.0-4

rust-debugsource: before 1.60.0-4

rust-debuginfo: before 1.60.0-4

rust-analysis: before 1.60.0-4

rls: before 1.60.0-4

clippy: before 1.60.0-4

cargo: before 1.60.0-4

rust: before 1.60.0-4

CPE2.3

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1811

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU67718

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-36114

CWE-ID: CWE-400 - Resource exhaustion