CVE-2022-21658 Race condition in std::fs::remove_dir_all in rustlang
An attacker can exploit a race condition in the Rust standard library to trick privileged programs into deleting unauthorized files or directories.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21658?
CVE-2022-21658 is a high-severity vulnerability in Apple Ipados, published on 20 Jan 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.
Which versions are affected by CVE-2022-21658?
It affects 7 products.
Linux distribution packages (40)
cargo AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
cargo-doc AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
clippy AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rls AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust-analysis AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust-debugger-common AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust-doc AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust-gdb AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust-lldb AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust-src AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust-std-static AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust-std-static-wasm32-unknown-unknown AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust-std-static-wasm32-wasi AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rust-toolset AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
rustfmt AlmaLinux:8 | All versions | 1.58.1-1.module_el8.6.0+2748+176088b3 |
cargo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
cargo-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
cargo-doc Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
clippy Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
clippy-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rls Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rls-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-analysis Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-debugger-common Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-doc Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-gdb Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-lldb Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-src Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-std-static Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-std-static-wasm32-unknown-unknown Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-std-static-wasm32-wasi Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust-toolset Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rustfmt Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rustfmt-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.58.1-1.module+el8.6.0+14021+586eff1a |
rust Rocky Linux:8 | All versions | 0:1.58.1-1.module+el8.6.0+826+60f85975 |
rust-toolset Rocky Linux:8 | All versions | 0:1.58.1-1.module+el8.6.0+826+60f85975 |
Products include Apple Ipados, Apple Iphone Os, Apple Macos, Apple Tvos, Apple Watchos, Fedoraproject Fedora and 1 more.
How do I fix CVE-2022-21658?
Upgrade to a fixed version.
Is CVE-2022-21658 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-21658 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apple Ipados
- CVE-2025-43300 Apple iOS, iPadOS, and macOS Out-of-Bounds Write
- CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write
- CVE-2025-24085 Apple Multiple Products Use-After-Free
- CVE-2025-31200 Apple Multiple Products Memory Corruption
- CVE-2025-31201 Apple Multiple Products Arbitrary Read and Write
Sources
Also known as ALSA-2022:1894, AZL-8337, DEBIAN-CVE-2022-21658, GHSA-r9cc-f5pr-p3j2, MGASA-2022-0044, RHSA-2022:1894 and 16 more.