** Description changed: - A full description of this CVE can be found on the rust-lang blog[1]. + [ Impact ] - Cargo incorrectly handles symlinks inside of crate tarballs downloaded - from third-party registries, allowing malicious crates to override the - source code of another crate from the same registry. + * A full description of this CVE can be found on the rust-lang blog[1]. - Starting with Rust 1.96.0, extracting any symlink within crate tarballs - shall be rejected, so any Rust version before that is affected. + * Cargo incorrectly handles symlinks inside of crate tarballs downloaded from + third-party registries, allowing malicious crates to override the source code + of another crate from the same registry. + + * Starting with Rust 1.96.0, extracting any symlink within the crate tarballs + shall be rejected, so any Rust version before 1.96.0 is affected. [1]: https://blog.rust-lang.org/2026/05/25/cve-2026-5223/ + + [ Test Plan ] + + * The patch cherry-picked from upstream provides a new unit test, + package_lock_as_a_symlink_inside_package_is_invalid, which validates that the + fix works properly. This can be checked by consulting the test status in the + package build log. This serves as an automated test. + + * However, the bug can be manually tested at runtime as well: + + 1. Setup + + # apt update && apt install -y cargo-1.80 + $ export TEMP_DIR=$(mktemp -d) + $ cd "$TEMP_DIR" + + 2. Build a malicious crate "bar 0.0.1" that contains a symlink + + $ mkdir -p bar-0.0.1/src + $ cat > bar-0.0.1/Cargo.toml <<'EOF' + [package] + name = "bar" + version = "0.0.1" + edition = "2021" + EOF + $ echo 'pub fn f() {}' > bar-0.0.1/src/lib.rs + $ ln -s src/lib.rs bar-0.0.1/nasty-link + $ mkdir -p registry/index/3/b + $ tar -czf registry/bar-0.0.1.crate bar-0.0.1 + $ export CKSUM=$(sha256sum "$TEMP_DIR/registry/bar-0.0.1.crate" | cut -d' ' -f1) + $ printf '{"name":"bar","vers":"0.0.1","deps":[],"cksum":"%s","features":{},"yanked":false}\n' "$CKSUM" > registry/index/3/b/bar + + 3. Create a consumer project which replaces crates.io with the local + registry + + $ mkdir -p foo/src foo/.cargo + $ cat > foo/Cargo.toml <<'EOF' + [package] + name = "foo" + version = "0.1.0" + edition = "2021" + + [dependencies] + bar = "0.0.1" + EOF + $ echo '' > foo/src/lib.rs + $ cat > foo/.cargo/config.toml <<EOF + [source.crates-io] + replace-with = "local" + + [source.local] + local-registry = "$TEMP_DIR/registry" + EOF + $ cd foo + + BEFORE: cargo succeeds and nasty-link is present + + $ rm -rf "$TEMP_DIR/cargo-home" + $ CARGO_HOME="$TEMP_DIR/cargo-home" cargo-1.80 fetch; echo "exit: $?" + [...] + exit: 0 + + $ ls -la "$TEMP_DIR"/cargo-home/registry/src/*/bar-0.0.1/ 2>/dev/null + [...] + lrwxrwxrwx 1 root root 10 Oct 7 20:35 nasty-link -> src/lib.rs + drwxr-xr-x 2 root root 4096 Oct 7 20:54 src + + AFTER: cargo rejects the tarball because it has a symlink + + $ rm -rf "$TEMP_DIR/cargo-home" + $ CARGO_HOME="$TEMP_DIR/cargo-home" cargo-1.80 fetch; echo "exit: $?" + [...] + error: failed to download `bar v0.0.1` + + Caused by: + unable to get packages from source + + Caused by: + failed to download replaced source registry `crates-io` + + Caused by: + failed to unpack package `bar v0.0.1 (registry `/tmp/tmp.w46KJhWH1c/registry`)` + + Caused by: + invalid tarball downloaded, contains an entry at "bar-0.0.1/nasty-link" with invalid type Symlink + exit: 101 + + [ Where problems could occur ] + + * This CVE fix is a change to what cargo allows when unpacking downloaded + .crate tarballs. If there are any entries in the tarball which aren't regular + files or directories, then cargo will abort with the following error message: + + invalid tarball downloaded, contains an entry at "<path>" with invalid + type <Type> + + * This means that if a given crate contains things other than regular files and + directories, the new version of cargo will suddenly refuse to unpack a crate + that used to work. + + * Luckily, it's very rare for a crate to contain things other than regular + files and directories. This is typically only possible for crates built by + hand or some third-party tool rather than by cargo itself. + + * Furthermore, any crates which suddently get rejected will fail with the clear + and informative error message detailed above. + + * However, this change will not affect the building of any Debian or Ubuntu + package -- all Debian/Ubuntu Rust packages use either "cargo vendor" output + or "/usr/share/cargo/registry" as their dependency sources. Neither of these + sources extract .crate tarballs, so the new check never runs when building + Debian/Ubuntu packages. + + * Therefore, the primary regression risk is to end users which use the cargo + package to develop their own Rust applications rather than Ubuntu developers. + + [ Other Info ] + + * In debian/changelog I have included a changelog entry referencing the + disabling of the selfbuild autopkgtest for infrastructure reasons, + purposefully omitting the # on the bug number. This is because it is not + fixing an existing bug -- it is simply disabling a test which has been known + to make things flaky in the past, and including the bug number gives useful + context. + + * Instead of fixing every single Rust release on every single Ubuntu release, + we are targeting only the newest Rust release on every supported Ubuntu + release -- users on a given Ubuntu series can fix the issues by upgrading + their Rust toolchain version.
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2154209 Title: CVE-2026-5223: Crates in third party registries can override the cached source of other crates To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rustc-1.62/+bug/2154209/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
