CVE-2023-38497: 
Rust vulnerability analysis and mitigation

CVE-2023-38497 affects Cargo, the package manager for the Rust programming language, in versions prior to 0.72.2 (bundled with Rust prior to version 1.71.1). The vulnerability was discovered and disclosed on August 3, 2023. The issue affects UNIX-like systems (like macOS and Linux) where Cargo failed to respect the umask when extracting crate archives (Rust Blog, GitHub Advisory).

The vulnerability stems from Cargo not respecting the system's umask settings when extracting crate archives. In UNIX-like systems, each file has three sets of permissions: for the user owning the file, for the group owning the file, and for all other local users. The umask is configured to limit those permissions during file creation, removing dangerous ones. When Cargo downloads a dependency, it extracts the source code to disk for compilation, but it propagated the permissions stored in the crate archive as-is, bypassing the system's umask protection (GitHub Advisory).

If a user downloaded a crate containing files writeable by any local user, another local user could exploit this vulnerability to modify the source code that would be compiled and executed by the current user. This could potentially lead to code execution with the privileges of the user compiling the code (NVD).

The primary mitigation is to update to Rust version 1.71.1 or later, which includes Cargo 0.72.2 that fixes the vulnerability. The fixed version respects the umask when extracting crate archives and will automatically purge caches generated by older versions. For users unable to update, a workaround is to prevent other local users from accessing the Cargo directory using the command: chmod go= ~/.cargo (GitHub Advisory).

The vulnerability was responsibly disclosed by Addison Crump according to the Rust security policy. The Rust Security Response WG coordinated the disclosure, with Weihang Lo developing the fix and Eric Huss reviewing it. Major Linux distributions like Fedora quickly released security updates to address the vulnerability (Fedora Update).