The vulnerability, which carries a perfect 10 base severity score, is tracked as CVE-2024-24576. It affects the Rust standard library, which was found to be improperly escaping arguments when invoking batch files on Windows using the Command API.
You must log in or register to comment.
Interesting how this has been widely reported as a Rust issue but the fact that other languages have no patches yet or do not even plan to patch it has seen little attention.
Seems like a Windows issue, not a Rust one. Odd choice to assign it to Rust.
Yeah, seems very much like “Rust fails to implement elaborate enough workaround for a stupid design choice in Windows”.
I think it’s because it was first identified in Rust so news media ran with that.
I think it’s partly because Rust has been promoted as inherently secure.
But nothing is so secure that it automatically fixes all design flaws in everything it interacts with.
Absolutely. I merely suggested a contributing factor to answer why media coverage seems so focused on Rust.
This is the best summary I could come up with:
Programmers are being urged to update their Rust versions after the security experts working on the language addressed a critical vulnerability that could lead to malicious command injections on Windows machines.
It affects the Rust standard library, which was found to be improperly escaping arguments when invoking batch files on Windows using the Command API.
“An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping,” said Pietro Albini of the Rust Security Response Working Group, who wrote the advisory.
The language is a fan favorite, routinely topping Stack Overflow’s rankings for how enjoyable developers find Rust to use in their work, and Googlers hail its productivity benefits.
According to RyotaK, the researcher who reported the vulnerability, which they are referring to as BatBadBut due to it revolving around batch files and its severity – “bad, but not the worst” – the issue affects more technologies than Rust alone.
RyotaK also made the point that users should not jump to conclusions based on the CVSS rating alone, since the severity of the issue will depend on each application individually and should be recalculated as such.
The original article contains 552 words, the summary contains 195 words. Saved 65%. I’m a bot and I’m open source!
Good bot