CVE-2022-21658

What it actually does

Race condition in std::fs::remove_dir_all enables symlink following (CWE-363), allowing a privileged process to delete attacker-controlled targets during recursive directory removal.

Why it matters to the business

Privileged Rust-based daemons or setuid binaries on affected systems could suffer unauthorized deletion of files and directories, causing data loss or service disruption; low urgency given stable low EPSS, no KEV listing, and publication over four years ago, though privileged contexts remain highest risk.

How an attack unfolds

An attacker with local access prepares a directory tree containing symlinks, then triggers a privileged Rust program calling remove_dir_all while racing to swap links to point at protected files; the available public exploit demonstrates the timing window on unpatched 1.0.0-1.58.0 toolchains.

How to fix it

Upgrade Rust toolchain to 1.58.1 or later; apply u-boot fixes including 2022.07+dfsg-1 (Debian 12/13), 2020.10+dfsg-1ubuntu0~18.04.3 (Ubuntu 18.04), 2021.01+dfsg-3ubuntu0~20.04.5 (Ubuntu 20.04), and 2022.01+dfsg-2ubuntu2.3 (Ubuntu 22.04). macOS <10.10 and REDOX targets receive no mitigation.

How to confirm the fix worked

Run rustc --version to confirm >=1.58.1; verify u-boot package versions match listed fixed releases; test remove_dir_all behavior under symlink race conditions on updated builds.

Typical attack path

1. Locate a privileged process invoking remove_dir_all on a writable path
2. Create initial directory structure with placeholder files
3. Race symlink creation/replacement during recursive deletion
4. Observe deletion of attacker-chosen targets outside the original directory

How to detect it

Review system and application logs for unexpected deletions of files outside expected directories during execution of Rust-compiled binaries; correlate with process creation timestamps around remove_dir_all calls; no widespread threat-actor campaigns reported.

What your security team should do

• Prioritize Rust 1.58.1+ deployment for any privileged or daemon code
• Audit call sites of remove_dir_all in internal Rust applications
• Track downstream dependents for u-boot updates in Debian/Ubuntu fleets
• Disable or sandbox affected binaries on unsupported macOS/REDOX platforms