Gentoo update for Rust

Published: 2024-09-22

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-46176 CVE-2023-38497
CWE-ID	CWE-347 CWE-276
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #2 is available.
Vulnerable software	Gentoo Linux Operating systems & Components / Operating system dev-lang/rust-bin Operating systems & Components / Operating system package or component dev-lang/rust Operating systems & Components / Operating system package or component
Vendor	Gentoo

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU71491

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-46176

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to Cargo does not perform SSH host key verification when cloning indexes and dependencies via SSH. A remote attacker can perform MitM attack.

Mitigation

Update the affected packages.
dev-lang/rust to version: 1.71.1
dev-lang/rust-bin to version: 1.71.1

Vulnerable software versions

Gentoo Linux: All versions

dev-lang/rust-bin: before 1.71.1

dev-lang/rust: before 1.71.1

CPE2.3

External links

https://security.gentoo.org/glsa/202409-07

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Incorrect default permissions

EUVDB-ID: #VU78930

Risk: Low

CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2023-38497

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Cargo does not respect the umask when extracting crate archives on UNIX-like systems. A local user can change the source code compiled and executed by the current user.

Mitigation

Update the affected packages.
dev-lang/rust to version: 1.71.1
dev-lang/rust-bin to version: 1.71.1

Vulnerable software versions

Gentoo Linux: All versions

dev-lang/rust-bin: before 1.71.1

dev-lang/rust: before 1.71.1

CPE2.3

External links

https://security.gentoo.org/glsa/202409-07

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.