Paul Krill
Editor at Large

Rust 1.58.1 fixes dangerous race condition

news
Jan 21, 20221 min

Vulnerability would allow an attacker to trick a privileged program into deleting files and directories that the attacker otherwise could not access or delete.

1 weakest link broken rusted chain security breach hacked
Credit: Getty Images

This point release arriving January 20, 2022, just days after Rust 1.58, fixes a race condition in the std::fs::remove_dir_all standard library function. This vulnerability is tracked at CVE-2022-21658 and there was an advisory published. An attacker could use this security issue to trick a privileged program into deleting files and directories that the attacker otherwise could not access or delete. Rust versions 1.0 through 1.58 are affected by this vulnerability. Users are advised to update their toolchains and build programs with the updated compiler.

Rust 1.58.1 also addresses several regressions in diagnostics and tools introduced in Rust 1.58:

  • The non_send_fields_in_send_ty Clippy lint was found to have too many false positives and has been moved to the experimental lints group called “nursery”.
  • The useless_format Clippy lint was updated to handle captured identifiers in format strings, introduced in Rust 1.58.
  • A regression in Rustfmt preventing generated files from being formatted when passed through the standard input has been fixed.
  • An incorrect error message displayed by rustc in some cases has been fixed.
Paul Krill

Paul Krill is editor at large at InfoWorld. Paul has been covering computer technology as a news and feature reporter for more than 35 years, including 30 years at InfoWorld. He has specialized in coverage of software development tools and technologies since the 1990s, and he continues to lead InfoWorld’s news coverage of software development platforms including Java and .NET and programming languages including JavaScript, TypeScript, PHP, Python, Ruby, Rust, and Go. Long trusted as a reporter who prioritizes accuracy, integrity, and the best interests of readers, Paul is sought out by technology companies and industry organizations who want to reach InfoWorld’s audience of software developers and other information technology professionals. Paul has won a “Best Technology News Coverage” award from IDG.

More from this author