CVE-2023-38497
Published: 04 August 2023
Summary
CVE-2023-38497 is a high-severity Insecure Preserved Inherited Permissions (CWE-278) vulnerability in Rust-Lang Cargo. Its CVSS base score is 7.9 (High).
Operationally, ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Cargo prior to version 0.72.2, bundled with Rust prior to 1.71.1, failed to respect the umask when extracting crate archives on UNIX-like systems. This flaw, tracked under CWE-278 and CWE-732, allowed downloaded crates containing files writable by any local user to retain overly permissive permissions in the local cache directory, typically ~/.cargo.
A local attacker on the same system could therefore modify source files within another user's extracted crate cache. When the victim subsequently built or ran a project depending on that crate, the attacker's changes would be compiled and executed with the victim's privileges, yielding a CVSS 7.9 impact that affects confidentiality and integrity but not availability.
The official GitHub Security Advisory and accompanying Cargo commit instruct users to upgrade to Rust 1.71.1 or later; the updated Cargo binary automatically purges caches created by older versions. As an immediate workaround, administrators can restrict permissions on the Cargo directory so that other local users cannot access it.
The associated EPSS score has remained low and stable near 0.0566 with a peak of 0.0580, indicating no significant post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2308
Vulnerability details
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate…
more
containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Procedures support proper permission assignment for critical resources through documented controls.
Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.
Prevents overly permissive assignments to critical resources by limiting to task needs.
Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.
Training on permission management reduces incorrect permission assignments for critical resources.
Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.
Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.
Certification includes checking that permissions on critical resources are correctly assigned.