CVE-2022-36114: Cargo extracting malicious crates can fill the file system
(updated )
The Rust Security Response WG was notified that Cargo did not prevent extracting some malformed packages downloaded from alternate registries. An attacker able to upload packages to an alternate registry could fill the file system when Cargo downloaded the package.
The severity of this vulnerability is “low” for users of alternate registries. Users relying on crates.io are not affected.
Note that by design Cargo allows code execution at build time, due to build scripts and procedural macros. The vulnerabilities in this advisory allow performing a subset of the possible damage in a harder to track down way. Your dependencies must still be trusted if you want to be protected from attacks, as it’s possible to perform the same attacks with build scripts and procedural macros.
References
- github.com/advisories/GHSA-2hvr-h6gw-qrxp
- github.com/rust-lang/cargo
- github.com/rust-lang/cargo/commit/2b68d3c07a4a056264dc006ecb9f1354a0679cd3
- github.com/rust-lang/cargo/commit/d1f9553c825f6d7481453be8d58d0e7f117988a7
- github.com/rust-lang/cargo/commit/d87d57dbbda61754f4fab0f329a7ac520e062c46
- github.com/rust-lang/cargo/security/advisories/GHSA-2hvr-h6gw-qrxp
- nvd.nist.gov/vuln/detail/CVE-2022-36114
- security.gentoo.org/glsa/202210-09
Detect and mitigate CVE-2022-36114 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →