CVE-2022-21658
published 2022-01-20CVE-2022-21658: Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG…
PriorityP433medium6.3CVSS 3.1
AVLACHPRLUINSUCNIHAH
EPSS
1.38%
68.8th percentile
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_15.4_and_ipados | — | — |
| apple | ipados | < 15.4 | 15.4 |
| apple | iphone_os | < 15.4 | 15.4 |
| apple | macos | >= 12.0.0 < 12.3 | 12.3 |
| apple | macos_monterey | — | — |
| apple | tvos | < 15.4 | 15.4 |
| apple | tvos | — | — |
| apple | watchos | < 8.5 | 8.5 |
| apple | watchos | — | — |
| debian | rustc | < rustc 1.57.0+dfsg1-1 (bookworm) | rustc 1.57.0+dfsg1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_rust_1.59.0-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_rust_1.59.0-1_on_cbl_mariner_1.0 | — | — |
| rust-lang | rust | < 1.58.1 | 1.58.1 |
| rust-lang | rust | 1.0.0 – 1.58.0 | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
nvdv2.03.3LOWAV:L/AC:M/Au:N/C:N/I:P/A:P
osv6.3MEDIUM
vendor_debian7.3HIGH
vendor_redhat7.3HIGH
vendor_msrc6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIDIS Prime
cisa_ics·2025-04-10
Siemens SIDIS Prime
ICS Advisory
##
Siemens SIDIS Prime
Release DateApril 10, 2025
Alert CodeICSA-25-100-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIDIS Prime
- Vulnerabilities: Race Condition Enabling Link Following, Improper Validation of Integrity Check Value, Unchecked Input for Loo
Apple
CVE-2022-21658: tvOS 15.4
vendor_apple·2022-03-14·CVSS 7.3
CVE-2022-21658 [HIGH] CVE-2022-21658: tvOS 15.4
Apple Security Update: About the security content of tvOS 15.4
Product: tvOS
Version: 15.4
CVE: CVE-2022-21658
Component: LLVM
Impact: An application may be able to delete files for which it does not have permission
Description: A race condition was addressed with additional validation.
Apple
CVE-2022-21658: iOS 15.4 and iPadOS 15.4
vendor_apple·2022-03-14·CVSS 7.3
CVE-2022-21658 [HIGH] CVE-2022-21658: iOS 15.4 and iPadOS 15.4
Apple Security Update: About the security content of iOS 15.4 and iPadOS 15.4
Product: iOS 15.4 and iPadOS
Version: 15.4
CVE: CVE-2022-21658
Component: LLVM
Impact: An application may be able to delete files for which it does not have permission
Description: A race condition was addressed with additional validation.
Apple
CVE-2022-21658: macOS Monterey 12.3
vendor_apple·2022-03-14·CVSS 7.3
CVE-2022-21658 [HIGH] CVE-2022-21658: macOS Monterey 12.3
Apple Security Update: About the security content of macOS Monterey 12.3
Product: macOS Monterey
Version: 12.3
CVE: CVE-2022-21658
Component: LLVM
Impact: An application may be able to delete files for which it does not have permission
Description: A race condition was addressed with additional validation.
Apple
CVE-2022-21658: watchOS 8.5
vendor_apple·2022-03-14·CVSS 7.3
CVE-2022-21658 [HIGH] CVE-2022-21658: watchOS 8.5
Apple Security Update: About the security content of watchOS 8.5
Product: watchOS
Version: 8.5
CVE: CVE-2022-21658
Component: LLVM
Impact: An application may be able to delete files for which it does not have permission
Description: A race condition was addressed with additional validation.
Red Hat
rust: Race condition in remove_dir_all leading to removal of files outside of the directory being removed
vendor_redhat·2022-01-20·CVSS 7.3
CVE-2022-21658 [HIGH] CWE-367 rust: Race condition in remove_dir_all leading to removal of files outside of the directory being removed
rust: Race condition in remove_dir_all leading to removal of files outside of the directory being removed
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a
Microsoft
Race condition in std::fs::remove_dir_all in rustlang
vendor_msrc·2022-01-11·CVSS 6.3
CVE-2022-21658 [HIGH] CWE-367 Race condition in std::fs::remove_dir_all in rustlang
Race condition in std::fs::remove_dir_all in rustlang
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://l
Debian
CVE-2022-21658: rustc - Rust is a multi-paradigm, general-purpose programming language designed for perf...
vendor_debian·2022·CVSS 7.3
CVE-2022-21658 [HIGH] CVE-2022-21658: rustc - Rust is a multi-paradigm, general-purpose programming language designed for perf...
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust
OSV
CVE-2022-21658: Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency
osv·2022-01-20·CVSS 6.3
CVE-2022-21658 [MEDIUM] CVE-2022-21658: Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust
No detection rules found.
No public exploits indexed.
HackerOne
Time-of-check to time-of-use vulnerability in the std::fs::remove_dir_all() function of the Rust standard library
hackerone·2022-03-24
[HIGH] Time-of-check to time-of-use vulnerability in the std::fs::remove_dir_all() function of the Rust standard library
Time-of-check to time-of-use vulnerability in the std::fs::remove_dir_all() function of the Rust standard library
The implementation of [`std::fs::remove_dir_all()`](https://doc.rust-lang.org/std/fs/fn.remove_dir_all.html) in the Rust standard library is vulnerable to a time-of-check to time-of-use link replacement attack. This applies to all versions of Rust before 1.58.1.
### Vulnerability details
The [documentation of `std::fs::remove_dir_all()`](https://doc.rust-lang.org/std/fs/fn.remove_dir_all.html) guarantees that the function does not follow symbolic links:
> Removes a directory at this path, after removing all its contents. Use carefully!
> This function does not follow symbolic links and it will simply remove the symbolic link itself.
The vulnerable implementation for Windows
arXiv
A Closer Look at the Security Risks in the Rust Ecosystem
arxiv_fulltext·2023-08-29
A Closer Look at the Security Risks in the Rust Ecosystem
A Closer Look at the Security Risks in the Rust Ecosystem
Xiaoye Zheng
Zhejiang University
Hangzhou
China
[email protected]
Zhiyuan Wan
Corresponding author.
Zhejiang University
Hangzhou
China
[email protected]
Yun Zhang
Hangzhou City University
Hangzhou
China
[email protected]
Rui Chang
Zhejiang University
Hangzhou
China
[email protected]
David Lo
Singapore Management University
Singapore
[email protected]
Zheng et al.
## Abstract
Rust is an emerging programming language designed for the development of systems software. To facilitate the reuse of Rust code, crates.io, as a central package registry of the Rust ecosystem, hosts thousands of third-party Rust packages. The openness of crates.io enables the growth of the Rust ecosystem but comes with security risks by
https://blog.rust-lang.org/2022/01/20/cve-2022-21658.htmlhttps://github.com/rust-lang/rust/pull/93110https://github.com/rust-lang/rust/pull/93110/commits/32ed6e599bb4722efefd78bbc9cd7ec4613cb946https://github.com/rust-lang/rust/pull/93110/commits/406cc071d6cfdfdb678bf3d83d766851de95abafhttps://github.com/rust-lang/rust/pull/93110/commits/4f0ad1c92ca08da6e8dc17838070975762f59714https://github.com/rust-lang/rust/security/advisories/GHSA-r9cc-f5pr-p3j2https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JKZDTBMGAWIFJSNWKBMPO5EAKRR4BEW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BK32QZLHDC2OVLPKTUHNT2G3VHWHD4LX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63NH72Q7UHJM5V3IVYRI7LVBGGFQMSQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKGTACKMKAPRDPWPTU26GYWBELIRFF5N/https://security.gentoo.org/glsa/202210-09https://support.apple.com/kb/HT213182https://support.apple.com/kb/HT213183https://support.apple.com/kb/HT213186https://support.apple.com/kb/HT213193https://blog.rust-lang.org/2022/01/20/cve-2022-21658.htmlhttps://github.com/rust-lang/rust/pull/93110https://github.com/rust-lang/rust/pull/93110/commits/32ed6e599bb4722efefd78bbc9cd7ec4613cb946https://github.com/rust-lang/rust/pull/93110/commits/406cc071d6cfdfdb678bf3d83d766851de95abafhttps://github.com/rust-lang/rust/pull/93110/commits/4f0ad1c92ca08da6e8dc17838070975762f59714https://github.com/rust-lang/rust/security/advisories/GHSA-r9cc-f5pr-p3j2https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JKZDTBMGAWIFJSNWKBMPO5EAKRR4BEW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BK32QZLHDC2OVLPKTUHNT2G3VHWHD4LX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63NH72Q7UHJM5V3IVYRI7LVBGGFQMSQ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKGTACKMKAPRDPWPTU26GYWBELIRFF5N/https://security.gentoo.org/glsa/202210-09https://support.apple.com/kb/HT213182https://support.apple.com/kb/HT213183https://support.apple.com/kb/HT213186https://support.apple.com/kb/HT213193
2022-01-20
Published