CVE-2022-21658: 
Bottlerocket vulnerability analysis and mitigation

The Rust Security Response WG identified a race condition vulnerability (CVE-2022-21658) in the std::fs::removedirall standard library function that enables symlink following (CWE-363). The vulnerability affects Rust versions 1.0.0 through 1.58.0. This security issue could allow an attacker to trick a privileged program into deleting files and directories that the attacker couldn't otherwise access or delete (Rust Blog).

The vulnerability stems from an incorrect implementation of symlink protection in std::fs::removedirall. Instead of instructing the system not to follow symlinks, the standard library first checked if the target was a symlink before proceeding with recursive deletion. This created a Time-of-check Time-of-use (TOCTOU) race condition where an attacker could create a directory and replace it with a symlink between the check and deletion. While not guaranteed to succeed on first attempt, the attack could be reliably executed within seconds (Rust Blog, Hacker News).

An unprivileged attacker could exploit this vulnerability to delete files and directories they normally wouldn't have permission to access by tricking privileged programs that use std::fs::removedirall. This is particularly concerning for system daemons and setuid binaries running with elevated privileges (Rust Blog).

The vulnerability was fixed in Rust 1.58.1. Users are strongly recommended to update to this version, especially for programs running in privileged contexts. Adding manual checks before calling removedirall does not mitigate the vulnerability as they would be subject to the same race condition. Some platforms including macOS before version 10.10 and REDOX remain vulnerable even with patched toolchains due to API limitations (Rust Blog).

The vulnerability received significant attention in the Rust community and broader security industry. Multiple Linux distributions including Fedora and Gentoo issued security advisories and updates. Apple also incorporated fixes for this vulnerability in their iOS 15.4, iPadOS 15.4, macOS Monterey 12.3, tvOS 15.4 and watchOS 8.5 releases (Fedora Update, Gentoo Security).