7.9 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
0.0004 Low
EPSS
Percentile
5.1%
Cargo downloads the Rust project’s dependencies and compiles the project.
Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1,
did not respect the umask when extracting crate archives on UNIX-like
systems. If the user downloaded a crate containing files writeable by any
local user, another local user could exploit this to change the source code
compiled and executed by the current user. To prevent existing cached
extractions from being exploitable, the Cargo binary version 0.72.2
included in Rust 1.71.1 or later will purge caches generated by older Cargo
versions automatically. As a workaround, configure one’s system to prevent
other local users from accessing the Cargo directory, usually located in
~/.cargo
.
Author | Note |
---|---|
sbeattie | cargo in mantic was merged into rustc |
alexmurray | requires an update to the tar rust dependency (tar 0.4.39) - this is packaged as rust-tar in Ubuntu but only the rust-cargo package appears to use this - rustc and cargo both vendor a copy of this package |
litios | a workaround for this issue is to prevent access to the ~/.cargo directory to other users. |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | cargo | < 0.66.0+ds0ubuntu0.libgit2-0ubuntu0.18.04.1~esm1 | UNKNOWN |
ubuntu | 20.04 | noarch | cargo | < 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2+esm1 | UNKNOWN |
ubuntu | 22.04 | noarch | cargo | < 0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2+esm1 | UNKNOWN |
ubuntu | 16.04 | noarch | cargo | < 0.47.0-1~exp1ubuntu1~16.04.1+esm1 | UNKNOWN |
ubuntu | 22.04 | noarch | rust-cargo | < 0.57.0-1ubuntu0.1~esm1 | UNKNOWN |
ubuntu | 23.10 | noarch | rust-cargo | < any | UNKNOWN |
ubuntu | 24.04 | noarch | rust-cargo | < any | UNKNOWN |
ubuntu | 23.10 | noarch | rustc | < any | UNKNOWN |
ubuntu | 24.04 | noarch | rustc | < any | UNKNOWN |
github.com/alexcrichton/tar-rs/commit/1fd8b4ef309087d138c55aab7b38ad7e15993c96
github.com/rust-lang/cargo/security/advisories/GHSA-j3xp-wfr4-hx87
github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2023-38497
launchpad.net/bugs/cve/CVE-2023-38497
nvd.nist.gov/vuln/detail/CVE-2023-38497
security-tracker.debian.org/tracker/CVE-2023-38497
ubuntu.com/security/notices/USN-6275-1
www.cve.org/CVERecord?id=CVE-2023-38497