Bug 2228038 (CVE-2023-38497)

Summary:	CVE-2023-38497 rust-cargo: cargo does not respect the umask when extracting dependencies
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bodavis, emachado, jcajka, jchecahi, jistone, mnewsome, security-response-team, sipoyare, tstellar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rust 1.71.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the rust-cargo package. Cargo, as bundled with the Rust compiler, did not respect the umask when extracting dependency tarballs and caching the extraction for future builds. If a dependency contained files with 0777 permissions, another local user could edit the cache of the extracted source code, potentially executing arbitrary code with the privileges of the user running Cargo during the next build.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-15 04:20:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2228132, 2228133, 2228134, 2228135, 2228136, 2228137, 2228138, 2228139, 2228140, 2228141, 2229138, 2229139, 2229140, 2229141
Bug Blocks:	2227802

Description Marian Rehak 2023-08-01 07:58:46 UTC

Cargo, as bundled with the Rust compiler, did not respect the umask when extracting dependency tarballs and caching the extraction for future builds. If a dependency contained files with 0777 permissions, another local user could edit the cache of the extracted source code, potentially executing arbitrary code with the privileges of the user running Cargo during the next build.

Comment 10 Marian Rehak 2023-08-04 11:01:30 UTC

Created rust tracking bugs for this issue:

Affects: epel-7 [bug 2229138]
Affects: fedora-37 [bug 2229139]
Affects: fedora-38 [bug 2229140]


Created rust-cargo tracking bugs for this issue:

Affects: fedora-all [bug 2229141]

Comment 12 errata-xmlrpc 2023-08-14 14:17:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4634 https://access.redhat.com/errata/RHSA-2023:4634

Comment 13 errata-xmlrpc 2023-08-14 14:29:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4635 https://access.redhat.com/errata/RHSA-2023:4635

Comment 14 errata-xmlrpc 2023-08-15 00:10:32 UTC

This issue has been addressed in the following products:

  Red Hat Developer Tools

Via RHSA-2023:4651 https://access.redhat.com/errata/RHSA-2023:4651

Comment 15 Product Security DevOps Team 2023-08-15 04:20:06 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-38497

Comment 16 errata-xmlrpc 2024-05-28 13:35:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:3428 https://access.redhat.com/errata/RHSA-2024:3428

Comment 17 errata-xmlrpc 2024-05-28 14:05:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:3418 https://access.redhat.com/errata/RHSA-2024:3418