The life of a Rust security vulnerability
summary
Rust Security Response WG handles a real case: CVE-2022-21658 is a race in std::fs::remove_dir_all that allows an unprivileged actor to make a privileged process delete arbitrary directories; proof-of-concept runs reliably within one second. Response uses GitHub security advisories to create private forks, requests a CVE, and coordinates three platform-specific fixes (Unix, Windows, wasi). Disclosure runs under embargo with prepared patches for nightly/beta/stable, releases taking four to nine hours, and an unexpected impact on parts of the C++ ecosystem.
AI-written summary · about
chapters (10)
- 0:00Start
- 5:18Receiving a report
- 8:03Reproducing the issue
- 8:48Involving domain experts
- 9:19Assessing the impact
- 13:54Writing and reviewing the fix
- 15:41Drafting a security advisory
- 18:49Requesting a CVE ID
- 26:01Recommending the reporter to notify Meta
- 28:01Request a CVE for vulnerabilities
related talks
29mSecuring Container Runtimes -- How Hard Can It Be?
18mWhat You Need to Know and Do about Vulnerability Disclosure
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
52mAnatomy of a Vulnerability Response - A View from the Inside
41mThe CVE Blind Spot: Defeating "Hidden EOLs" and Repo Jacking with Engineering Triage & Code Diet
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
27mVulnerability Response of Last Resort
45mBuilding Safe and Secure Systems in Rust