Security advisory for the standard library (CVE-2024-24576)
Security advisory for the standard library (CVE-2024-24576)
Empowering everyone to build reliable and efficient software.
You're viewing a single thread.
This sounds like a pretty big deal for crates with custom build.rs files.
How so? This exploit requires running a shell command in a way that permits an attacker to control the arguments provided. That doesn't seem like it would be particularly common in build scripts.
I'm thinking an xz-style attack where a malicious actor submits an "improvement" with an innocuous-looking change to the build script that ends up running arbitrary commands. Running a batch script seems like a reasonable thing for a build script to do (e.g. to run something like i18n or whatever), and a lot of project devs may not know much about how batch scripts work (many devs are more familiar with Linux-compatible shell scripts), so it could slip through. The batch script itself could be innocuous and thus not be caught by a reviewer.
That's not going to be particularly feasible when generating bindings and other complex build processes. For example, the Qt bindings run shell commands as part of the build.rs. As does gettext-rs.
So I don't think it's unreasonable to think a developer could sneak in an exploit with "temporary code" to improve some part of the build process on Windows.
I’d instantly reject such an approach. Find a better way to do things.