https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 11:59:28 +0000 https://db.gcve.eu/vuln/rustsec-2023-0018 <p><strong>Affected:</strong> crates.io: remove_dir_all</p> <p>The remove_dir_all crate is a Rust library that offers additional features over the Rust standard library fs::remove_dir_all function.</p> <p>It was possible to trick a privileged process doing a recursive delete in an attacker controlled directory into deleting privileged files, on all operating systems.</p> <p>For instance, consider deleting a tree called &#39;etc&#39; in a parent directory called &#39;p&#39;. Between calling `remove_dir_all(&#34;a&#34;)` and remove_dir_all(&#34;a&#34;) actually starting its work, the attacker can move &#39;p&#39; to &#39;p-prime&#39;, and replace &#39;p&#39; with a symlink to &#39;/&#39;. Then the privileged process deletes &#39;p/etc&#39; which is actually /etc, and now your system is broken. There are some mitigations for this exact scenario, such as CWD relative file lookup, but they are not guaranteed - any code using absolute paths will not have that protection in place.</p> <p>The same attack could be performed at any point in the directory tree being deleted: if &#39;a&#39; contains a child directory called &#39;etc&#39;, attacking the deletion by replacing &#39;a&#39; with a link is possible.</p> <p>The new code in this release mitigates the attack within the directory tree being deleted by using file-handle relative operations: to open &#39;a/etc&#39;, the path &#39;etc&#39; relative to &#39;a&#39; is opened, where &#39;a&#39; is represented by a file descriptor (Unix) or handle (Windows). With the exception of the entry points into the directory deletion logic, this is robust against manipulation of the directory hierarchy, and remove_dir_all will only delete files and director…</p> <p><strong>Affected:</strong> crates.io: remove_dir_all</p> <p>The remove_dir_all crate is a Rust library that offers additional features over the Rust standard library fs::remove_dir_all function.</p> <p>It was possible to trick a privileged process doing a recursive delete in an attacker controlled directory into deleting privileged files, on all operating systems.</p> <p>For instance, consider deleting a tree called &#39;etc&#39; in a parent directory called &#39;p&#39;. Between calling `remove_dir_all(&#34;a&#34;)` and remove_dir_all(&#34;a&#34;) actually starting its work, the attacker can move &#39;p&#39; to &#39;p-prime&#39;, and replace &#39;p&#39; with a symlink to &#39;/&#39;. Then the privileged process deletes &#39;p/etc&#39; which is actually /etc, and now your system is broken. There are some mitigations for this exact scenario, such as CWD relative file lookup, but they are not guaranteed - any code using absolute paths will not have that protection in place.</p> <p>The same attack could be performed at any point in the directory tree being deleted: if &#39;a&#39; contains a child directory called &#39;etc&#39;, attacking the deletion by replacing &#39;a&#39; with a link is possible.</p> <p>The new code in this release mitigates the attack within the directory tree being deleted by using file-handle relative operations: to open &#39;a/etc&#39;, the path &#39;etc&#39; relative to &#39;a&#39; is opened, where &#39;a&#39; is represented by a file descriptor (Unix) or handle (Windows). With the exception of the entry points into the directory deletion logic, this is robust against manipulation of the directory hierarchy, and remove_dir_all will only delete files and director…</p> https://db.gcve.eu/vuln/rustsec-2023-0018