Skip to content

Commit 1241ea4

Browse files
authored
List Unix-like target OSes as affected by CVE-2025-22620 (#2196)
This builds on #2193 by listing all Unix-like target operating systems as affected (since a category of OSes like "unix" cannot currently be represented in RUSTSEC advisory metadata). The list was obtained by running the command given in: #1911 (comment) The vulnerability is specific to Unix-like operating systems because: - The vulnerable code runs only in the `unix` build configuration. - 0777 permissions are meaningful on such systems and (due to containing 0002) allow any user account on the system to write. Therefore, if there are any Unix-like systems where Unix-style filesystem permissions are not used, or that are *truly* single user (i.e. do not use multiple user accounts, not even for running daemons with limited privileges), then this vulnerability would not affect such systems. In addition, I have not attempted specifically to run the proof of concept for the vulnerability on most of the listed operating systems, nor examined whether `gix-worktree-state` might not be usable on some of them for reasons unrealted to this vulnerability. Conversely, if new target OSes are added in the future, and they are Unix-like, then they would probably be vulnerable, even though not listed here. (It may not be likely that anyone would be using an affected version of `gix-worktree-state` by that time, though.)
1 parent d3d1ba6 commit 1241ea4

File tree

1 file changed

+32
-0
lines changed

1 file changed

+32
-0
lines changed

crates/gix-worktree-state/RUSTSEC-0000-0000.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,38 @@ keywords = ["permissions"]
99
aliases = ["CVE-2025-22620"]
1010
license = "CC0-1.0"
1111

12+
[affected]
13+
# This vulnerability affects Unix-like operating systems.
14+
os = [
15+
"aix",
16+
"android",
17+
"dragonfly",
18+
"emscripten",
19+
"espidf",
20+
"freebsd",
21+
"fuchsia",
22+
"haiku",
23+
"horizon",
24+
"hurd",
25+
"illumos",
26+
"ios",
27+
"l4re",
28+
"linux",
29+
"macos",
30+
"netbsd",
31+
"nto",
32+
"nuttx",
33+
"openbsd",
34+
"redox",
35+
"rtems",
36+
"solaris",
37+
"tvos",
38+
"visionos",
39+
"vita",
40+
"vxworks",
41+
"watchos",
42+
]
43+
1244
[affected.functions]
1345
"gix_worktree_state::checkout" = ["< 0.17.0"]
1446

0 commit comments

Comments
 (0)