CVE catalog
CVE-2022-21658
rustc: CVE-2022-21658
- Severity
- High · CVSS 7.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.38% · Oct 25, 2026
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete. Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability with 1.58.1 containing a patch. Note that the following build targets don't have usable APIs to properly mitigate the attack, and are thus still vulnerable even with a patched toolchain: macOS before version 10.10 (Yosemite) and REDOX. We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this. Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rustc | sid | 1.97.1+dfsg1-1 | fixed |
| Debian | rustc | forky | 1.97.1+dfsg1-1 | fixed |
| Debian | rustc | trixie | 1.85.1+dfsg1-1+deb13u1 | fixed |
| Debian | rustc | bookworm | 1.63.0+dfsg1-2 | fixed |
| Ubuntu | rustc | pro | 1.7.0+dfsg1-1 | vulnerable |
| Ubuntu | rustc | pro | 1.15.1+dfsg0-1~exp1ubuntu2~16.04.3 | vulnerable |
| Ubuntu | rustc | pro | 1.17.0+dfsg2-8~ubuntu0.16.04.2 | vulnerable |
| Ubuntu | rustc | pro | 1.21.0+dfsg1+llvm-0ubuntu3~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.22.1+dfsg1+llvm-0ubuntu2~16.04.2 | vulnerable |
| Ubuntu | rustc | pro | 1.24.1+dfsg1+llvm-0ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.25.0+dfsg1+llvm-0ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.28.0+dfsg1+llvm-0ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.30.0+dfsg1+llvm-2ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.31.0+dfsg1+llvm-2ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.32.0+dfsg1+llvm-1ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.34.1+dfsg2+llvm-0ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.35.0+dfsg0.1+llvm-0ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.36.0+dfsg1+llvm-2ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.37.0+dfsg1+llvm-1ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.39.0+dfsg1+llvm-3ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.41.0+dfsg1+llvm-0ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.47.0+dfsg1+llvm-1ubuntu1~16.04.1 | vulnerable |
| Ubuntu | rustc | pro | 1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.37.0+dfsg1+llvm-1ubuntu1 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.38.0+dfsg0.2+llvm-0ubuntu1 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.38.0+dfsg0.2+llvm-0ubuntu2 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.39.0+dfsg1+llvm-3ubuntu1 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.40.0+dfsg1+llvm-5ubuntu1 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.41.0+dfsg1+llvm-0ubuntu1 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.41.0+dfsg1+llvm-0ubuntu2 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.47.0+dfsg1+llvm-1ubuntu1~20.04.1 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.53.0+dfsg1+llvm-4ubuntu1~20.04.1 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.57.0+dfsg1+llvm-0ubuntu1~20.04.1 | vulnerable |
| Ubuntu | rustc | 20.04 | 1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2 | fixed |
| Opensuse | rust1.58 | tumbleweed | 1.58.0-2.1 | fixed |
| Suse | rust1.57 | linux enterprise module for development tools 15 sp3 | 1.57.0-150300.7.7.1 | fixed |
| Opensuse | rust1.57 | leap 15.3 | 1.57.0-150300.7.7.1 | fixed |
| Opensuse | rust1.56 | tumbleweed | 1.56.1-4.1 | fixed |
| Suse | rust | linux enterprise high performance computing 15-espos | 1.53.0-3.40.1 | fixed |
| Suse | rust | linux enterprise high performance computing 15-ltss | 1.53.0-3.40.1 | fixed |
| Suse | rust | linux enterprise server 15-ltss | 1.53.0-3.40.1 | fixed |
| Suse | rust | linux enterprise server for sap applications 15 | 1.53.0-3.40.1 | fixed |
| Opensuse | rust1.57 | tumbleweed | 1.57.0-3.1 | fixed |
| Suse | libredwg | package hub 15 sp3 | 0.12.5-bp153.2.3.1 | fixed |
| Opensuse | libredwg | leap 15.3 | 0.12.5-bp153.2.3.1 | fixed |
| Opensuse | rust1.56 | leap 15.3 | 1.56.1-150300.7.6.1 | fixed |
| Opensuse | rust | leap 15.3 | 1.53.0-22.1 | fixed |
| Opensuse | rust | leap 15.3 | 1.59.0-150300.21.20.1 | fixed |
| Opensuse | rust1.58 | leap 15.3 | 1.58.0-150300.7.3.1 | fixed |
| Opensuse | rust1.59 | leap 15.3 | 1.59.0-150300.7.4.2 | fixed |
| Suse | rust | linux enterprise module for development tools 15 sp3 | 1.59.0-150300.21.20.1 | fixed |
| Suse | rust1.58 | linux enterprise module for development tools 15 sp3 | 1.58.0-150300.7.3.1 | fixed |
| Suse | rust1.59 | linux enterprise module for development tools 15 sp3 | 1.59.0-150300.7.4.2 | fixed |
| Suse | rust | linux enterprise high performance computing 15 sp1-espos | 1.53.0-22.1 | fixed |
| Suse | rust | linux enterprise high performance computing 15 sp1-ltss | 1.53.0-22.1 | fixed |
| Suse | rust | linux enterprise high performance computing 15 sp2-espos | 1.53.0-22.1 | fixed |
| Suse | rust | linux enterprise high performance computing 15 sp2-ltss | 1.53.0-22.1 | fixed |
| Suse | rust | linux enterprise real time 15 sp2 | 1.53.0-22.1 | fixed |
| Suse | rust | linux enterprise server 15 sp1-bcl | 1.53.0-22.1 | fixed |
| Suse | rust | linux enterprise server 15 sp1-ltss | 1.53.0-22.1 | fixed |
| Suse | rust | linux enterprise server 15 sp2-bcl | 1.53.0-22.1 | fixed |
| Suse | rust | linux enterprise server 15 sp2-ltss | 1.53.0-22.1 | fixed |
| Suse | rust | linux enterprise server for sap applications 15 sp1 | 1.53.0-22.1 | fixed |
| Suse | rust | linux enterprise server for sap applications 15 sp2 | 1.53.0-22.1 | fixed |
| Suse | rust | manager proxy 4.1 | 1.53.0-22.1 | fixed |
| Suse | rust | manager retail branch server 4.1 | 1.53.0-22.1 | fixed |
| Suse | rust | manager server 4.1 | 1.53.0-22.1 | fixed |
| Suse | rust | enterprise storage 6 | 1.53.0-22.1 | fixed |
| Suse | rust | enterprise storage 7 | 1.53.0-22.1 | fixed |
| Suse | rust1.56 | linux enterprise module for development tools 15 sp3 | 1.56.1-150300.7.6.1 | fixed |
| Opensuse | rust1.55 | leap 15.3 | 1.55.0-150300.7.6.1 | fixed |
| Suse | rust1.55 | linux enterprise module for development tools 15 sp3 | 1.55.0-150300.7.6.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rustc | source | sid | 1.57.0+dfsg1-1 | not yet assigned | Not reported | Not reported |
| Debian | rustc | source | forky | 1.57.0+dfsg1-1 | not yet assigned | Not reported | Not reported |
| Debian | rustc | source | trixie | 1.57.0+dfsg1-1 | not yet assigned | Not reported | Not reported |
| Debian | rustc | source | bookworm | 1.57.0+dfsg1-1 | not yet assigned | Not reported | Not reported |
| Ubuntu | rustc | deb | 20.04 | 1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2 | Not reported | UBUNTU-CVE-2022-21658 | Not reported |
| Opensuse | rust1.58 | rpm | tumbleweed | 1.58.0-2.1 | Not reported | OPENSUSE-SU-2024:11769-1 | Not reported |
| Suse | rust1.57 | rpm | linux enterprise module for development tools 15 sp3 | 1.57.0-150300.7.7.1 | Not reported | SUSE-SU-2022:0175-1 | Not reported |
| Opensuse | rust1.57 | rpm | leap 15.3 | 1.57.0-150300.7.7.1 | Not reported | OPENSUSE-SU-2022:0175-1 | Not reported |
| Opensuse | rust1.56 | rpm | tumbleweed | 1.56.1-4.1 | Not reported | OPENSUSE-SU-2024:11767-1 | Not reported |
| Suse | rust | rpm | linux enterprise high performance computing 15-espos | 1.53.0-3.40.1 | Not reported | SUSE-SU-2022:0200-1 | Not reported |
| Suse | rust | rpm | linux enterprise high performance computing 15-ltss | 1.53.0-3.40.1 | Not reported | SUSE-SU-2022:0200-1 | Not reported |
| Suse | rust | rpm | linux enterprise server 15-ltss | 1.53.0-3.40.1 | Not reported | SUSE-SU-2022:0200-1 | Not reported |
| Suse | rust | rpm | linux enterprise server for sap applications 15 | 1.53.0-3.40.1 | Not reported | SUSE-SU-2022:0200-1 | Not reported |
| Opensuse | rust1.57 | rpm | tumbleweed | 1.57.0-3.1 | Not reported | OPENSUSE-SU-2024:11768-1 | Not reported |
| Suse | libredwg | rpm | package hub 15 sp3 | 0.12.5-bp153.2.3.1 | Not reported | OPENSUSE-SU-2022:0149-1 | Not reported |
| Opensuse | libredwg | rpm | leap 15.3 | 0.12.5-bp153.2.3.1 | Not reported | OPENSUSE-SU-2022:0149-1 | Not reported |
| Opensuse | rust1.56 | rpm | leap 15.3 | 1.56.1-150300.7.6.1 | Not reported | OPENSUSE-SU-2022:0149-1 | Not reported |
| Opensuse | rust | rpm | leap 15.3 | 1.53.0-22.1 | Not reported | OPENSUSE-SU-2022:0491-1 | Not reported |
| Opensuse | rust | rpm | leap 15.3 | 1.59.0-150300.21.20.1 | Not reported | OPENSUSE-SU-2022:0843-1 | Not reported |
| Opensuse | rust1.58 | rpm | leap 15.3 | 1.58.0-150300.7.3.1 | Not reported | OPENSUSE-SU-2022:0843-1 | Not reported |
| Opensuse | rust1.59 | rpm | leap 15.3 | 1.59.0-150300.7.4.2 | Not reported | OPENSUSE-SU-2022:0843-1 | Not reported |
| Suse | rust | rpm | linux enterprise module for development tools 15 sp3 | 1.59.0-150300.21.20.1 | Not reported | SUSE-SU-2022:0843-1 | Not reported |
| Suse | rust1.58 | rpm | linux enterprise module for development tools 15 sp3 | 1.58.0-150300.7.3.1 | Not reported | SUSE-SU-2022:0843-1 | Not reported |
| Suse | rust1.59 | rpm | linux enterprise module for development tools 15 sp3 | 1.59.0-150300.7.4.2 | Not reported | SUSE-SU-2022:0843-1 | Not reported |
| Suse | rust | rpm | linux enterprise high performance computing 15 sp1-espos | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | linux enterprise high performance computing 15 sp1-ltss | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | linux enterprise high performance computing 15 sp2-espos | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | linux enterprise high performance computing 15 sp2-ltss | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | linux enterprise real time 15 sp2 | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | linux enterprise server 15 sp1-bcl | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | linux enterprise server 15 sp1-ltss | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | linux enterprise server 15 sp2-bcl | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | linux enterprise server 15 sp2-ltss | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | linux enterprise server for sap applications 15 sp1 | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | linux enterprise server for sap applications 15 sp2 | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | manager proxy 4.1 | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | manager retail branch server 4.1 | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | manager server 4.1 | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | enterprise storage 6 | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust | rpm | enterprise storage 7 | 1.53.0-22.1 | Not reported | SUSE-SU-2022:0491-1 | Not reported |
| Suse | rust1.56 | rpm | linux enterprise module for development tools 15 sp3 | 1.56.1-150300.7.6.1 | Not reported | SUSE-SU-2022:0149-1 | Not reported |
| Opensuse | rust1.55 | rpm | leap 15.3 | 1.55.0-150300.7.6.1 | Not reported | OPENSUSE-SU-2022:0171-1 | Not reported |
| Suse | rust1.55 | rpm | linux enterprise module for development tools 15 sp3 | 1.55.0-150300.7.6.1 | Not reported | SUSE-SU-2022:0171-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libstd-rust-1.63]Fixed
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· amd64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· arm64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [libstd-rust-dev]Fixed
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· amd64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· arm64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [libstd-rust-dev-wasm32]Fixed
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [libstd-rust-dev-windows]Fixed
Source package: [rustc]
Details (1)
1.63.0+dfsg1-2· amd64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [rust-all]Fixed
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [rustc]Fixed
Details (2)
1.63.0+dfsg1-2· amd64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· arm64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [rust-clippy]Fixed
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· amd64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· arm64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [rust-doc]Fixed
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [rustfmt]Fixed
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· amd64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· arm64 · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [rust-gdb]Fixed
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [rust-lldb]Fixed
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
- [rust-src]Fixed
Source package: [rustc]
Details (2)
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
1.63.0+dfsg1-2· all · bookwormFixed · Fixed:
1.57.0+dfsg1-1dsa · rustc · debian · bookworm
Observed:
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-277137.json]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2022_1894.json]
- [https://osv.dev/vulnerability/SUSE-SU-2022:0149-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:0171-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:0175-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:0200-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:0491-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:0843-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2022-21658]
- [https://osv.dev/vulnerability/openSUSE-SU-2022:0149-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2022:0171-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2022:0175-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2022:0491-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2022:0843-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:11767-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:11768-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:11769-1]
- [https://security-tracker.debian.org/tracker/CVE-2022-21658]
- [https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-21658.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0561.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]