Vulnerabilities

RUSTSEC-2021-0119

Out-of-bounds write in nix::unistd::getgrouplist

Details
Package	nix
Version	0.18.0
URL	nix-rust/nix#1541
Date	2021-09-27
Patched versions	^0.20.2,^0.21.2,^0.22.2,>=0.23.0
Unaffected versions	<0.16.0

On certain platforms, if a user has more than 16 groups, the
nix::unistd::getgrouplist function will call the libc getgrouplist
function with a length parameter greater than the size of the buffer it
provides, resulting in an out-of-bounds write and memory corruption.

The libc getgrouplist function takes an in/out parameter ngroups
specifying the size of the group buffer. When the buffer is too small to
hold all of the requested user's group memberships, some libc
implementations, including glibc and Solaris libc, will modify ngroups
to indicate the actual number of groups for the user, in addition to
returning an error. The version of nix::unistd::getgrouplist in nix
0.16.0 and up will resize the buffer to twice its size, but will not
read or modify the ngroups variable. Thus, if the user has more than
twice as many groups as the initial buffer size of 8, the next call to
getgrouplist will then write past the end of the buffer.

The issue would require editing /etc/groups to exploit, which is usually
only editable by the root user.

RUSTSEC-2021-0119

Out-of-bounds write in nix::unistd::getgrouplist

Details
Package	nix
Version	0.20.0
URL	nix-rust/nix#1541
Date	2021-09-27
Patched versions	^0.20.2,^0.21.2,^0.22.2,>=0.23.0
Unaffected versions	<0.16.0

On certain platforms, if a user has more than 16 groups, the
nix::unistd::getgrouplist function will call the libc getgrouplist
function with a length parameter greater than the size of the buffer it
provides, resulting in an out-of-bounds write and memory corruption.

The libc getgrouplist function takes an in/out parameter ngroups
specifying the size of the group buffer. When the buffer is too small to
hold all of the requested user's group memberships, some libc
implementations, including glibc and Solaris libc, will modify ngroups
to indicate the actual number of groups for the user, in addition to
returning an error. The version of nix::unistd::getgrouplist in nix
0.16.0 and up will resize the buffer to twice its size, but will not
read or modify the ngroups variable. Thus, if the user has more than
twice as many groups as the initial buffer size of 8, the next call to
getgrouplist will then write past the end of the buffer.

The issue would require editing /etc/groups to exploit, which is usually
only editable by the root user.

RUSTSEC-2023-0018

Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU)

Details
Package	remove_dir_all
Version	0.5.3
URL	XAMPPRocky/remove_dir_all@7247a8b
Date	2023-02-24
Patched versions	>=0.8.0

The remove_dir_all crate is a Rust library that offers additional features over the Rust
standard library fs::remove_dir_all function.

It was possible to trick a privileged process doing a recursive delete in an
attacker controlled directory into deleting privileged files, on all operating systems.

For instance, consider deleting a tree called 'etc' in a parent directory
called 'p'. Between calling remove_dir_all("a") and remove_dir_all("a")
actually starting its work, the attacker can move 'p' to 'p-prime', and
replace 'p' with a symlink to '/'. Then the privileged process deletes 'p/etc'
which is actually /etc, and now your system is broken. There are some
mitigations for this exact scenario, such as CWD relative file lookup, but
they are not guaranteed - any code using absolute paths will not have that
protection in place.

The same attack could be performed at any point in the directory tree being
deleted: if 'a' contains a child directory called 'etc', attacking the
deletion by replacing 'a' with a link is possible.

The new code in this release mitigates the attack within the directory tree
being deleted by using file-handle relative operations: to open 'a/etc', the
path 'etc' relative to 'a' is opened, where 'a' is represented by a file
descriptor (Unix) or handle (Windows). With the exception of the entry points
into the directory deletion logic, this is robust against manipulation of the
directory hierarchy, and remove_dir_all will only delete files and directories
contained in the tree it is deleting.

The entry path however is a challenge - as described above, there are some
potential mitigations, but since using them must be done by the calling code,
it is hard to be confident about the security properties of the path based
interface.

The new extension trait RemoveDir provides an interface where it is much
harder to get it wrong.

somedir.remove_dir_contents("name-of-child").

Callers can then make their own security evaluation about how to securely get
a directory handle. That is still not particularly obvious, and we're going to
follow up with a helper of some sort (probably in the fs_at crate). Once
that is available, the path based entry points will get deprecated.

In the interim, processes that might run with elevated privileges should
figure out how to securely identify the directory they are going to delete, to
avoid the initial race. Pragmatically, other processes should be fine with the
path based entry points : this is the same interface std::fs::remove_dir_all
offers, and an unprivileged process running in an attacker controlled
directory can't do anything that the attacker can't already do.

RUSTSEC-2023-0065

Tungstenite allows remote attackers to cause a denial of service

Details
Package	tungstenite
Version	0.18.0
URL	snapview/tungstenite-rs#376
Date	2023-09-25
Patched versions	>=0.20.1

The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause
a denial of service (minutes of CPU consumption) via an excessive length of an
HTTP header in a client handshake. The length affects both how many times a parse
is attempted (e.g., thousands of times) and the average amount of data for each
parse attempt (e.g., millions of bytes).

Warnings

RUSTSEC-2020-0168

mach is unmaintained

Details
Status	unmaintained
Package	mach
Version	0.1.2
URL	fitzgen/mach#63
Date	2020-07-14

Last release was almost 4 years ago.

Maintainer(s) seem to be completely unreachable.

Possible Alternative(s)

These may or may not be suitable alternatives and have not been vetted in any way;

• mach2 - direct fork

RUSTSEC-2021-0150

ncollide3d is unmaintained

Details
Status	unmaintained
Package	ncollide3d
Version	0.33.0
URL	https://github.com/dimforge/ncollide
Date	2021-01-29

The maintainer has advised that this crate is passively-maintained and that it
is being superseded by the Parry project.

RUSTSEC-2020-0016

net2 crate has been deprecated; use socket2 instead

Details
Status	unmaintained
Package	net2
Version	0.2.39
URL	deprecrated/net2-rs@3350e38
Date	2020-05-01

The net2 crate has been deprecated
and users are encouraged to considered socket2 instead.

RUSTSEC-2021-0140

rusttype is Unmaintained

Details
Status	unmaintained
Package	rusttype
Version	0.8.3
URL	https://gitlab.redox-os.org/redox-os/rusttype/-/issues/148
Date	2021-04-01

The maintainer has advised this crate is deprecated and will not
receive any maintenance.

The maintainer has further advised to migrate over to ab_glyph.

Last release seems to have been over two years ago.

Possible Alternative(s)

The below list has not been vetted in any way and may or may not contain alternatives;

• ab_glyph

RUSTSEC-2021-0140

rusttype is Unmaintained

Details
Status	unmaintained
Package	rusttype
Version	0.9.3
URL	https://gitlab.redox-os.org/redox-os/rusttype/-/issues/148
Date	2021-04-01

The maintainer has advised this crate is deprecated and will not
receive any maintenance.

The maintainer has further advised to migrate over to ab_glyph.

Last release seems to have been over two years ago.

Possible Alternative(s)

The below list has not been vetted in any way and may or may not contain alternatives;

• ab_glyph

RUSTSEC-2020-0020

stb_truetype crate has been deprecated; use ttf-parser instead

Details
Status	unmaintained
Package	stb_truetype
Version	0.3.1
URL	https://gitlab.redox-os.org/redox-os/stb_truetype-rs/-/commit/f1f5be4794e87bfc80a4255bc3f23ed75dd77645
Date	2020-04-18

This crate was maintained for use in rusttype which has switched to use ttf-parser

RUSTSEC-2018-0017

tempdir crate has been deprecated; use tempfile instead

Details
Status	unmaintained
Package	tempdir
Version	0.3.7
URL	rust-lang-deprecated/tempdir#46
Date	2018-02-13

The tempdir crate has been deprecated
and the functionality is merged into tempfile.