GHSA-mr6f-2w9f-qrf8: 
Rust vulnerability analysis and mitigation

Fixed in 0.2.0-preview.10; upgrade to it.

Impact

A run's budget limit was what was left of the tightest budget (the task's, its group's, the group's daily or the daily one), worked out from the runs' usage records, and a run's usage was recorded only once it ended. A run whose usage was never recorded (the record could not be written, for example on a full disk, which a task's commands can cause; or Kule could not read what the agent reported) was not counted, so later runs saw more budget left than there was. Runs started at the same time in different tasks under a shared budget did not see each other, and each could spend what was left.

Fix

Before an agent starts, Kule sets aside the run's share of its budgets, under a lock across its processes, with what other runs set aside counted as spent. Runs started at once share what is left, and a run is refused, naming the budget and the tasks, while what is left is set aside. A share that cannot be written starts no run. A run's usage record closes its share; a run whose usage never comes counts at its whole share (for a daily budget until the 24 hours pass). kule budget TASK --release lets go of the share of a run that did not end, knowingly, refused while an agent is at work, and keeps a record of it. The CLI and the app say what is set aside.

Tests

a_run_whose_cost_is_not_recorded_stays_counted_at_its_reservation, runs_started_together_share_what_is_left, a_reservation_that_cannot_be_written_starts_no_run, a_daily_reservation_ages_out, a_share_counts_for_the_group, a_reservation_of_a_run_at_work_is_not_released (kule-engine), a_run_reserves_before_its_agent_starts (kule-daemon), releasing_an_unfinished_reservation_is_said_and_kept (kule CLI).

Workaround

Upgrade to 0.2.0-preview.10.