https://seclists.org/oss-sec/2023/q3/90: CVE-2023-38497: Cargo does not respect umask when extracting packages
Affected Software
Frequently Asked Questions
Who can exploit this issue?
A local user who can modify extracted crate files that Cargo made writable can alter source code before it is compiled and executed by the Cargo user. The issue is relevant on UNIX-like systems where multiple local users share access to the affected cache files.
Does a typical default umask prevent exploitation?
The default umask on macOS and most Linux distributions normally removes group and other write permissions from newly created files. Cargo did not respect that umask when extracting crate archives, so protection depends on the permissions stored in the downloaded crate rather than the user's normal umask.
When does the risky file extraction occur?
Cargo extracts a dependency when it is first used and caches the extracted files for later invocations. A malicious local user would need an opportunity to modify a writable extracted file before the Cargo user's source is compiled and executed.