Incomplete fix for CVE-2024-24576 in Rust 1.81.0 allows bypass of mitigations

CVE-2024-43402

What is CVE-2024-43402?

A notable vulnerability in the Rust programming language related to batch file invocation on Windows has been identified. The issue arises from an incomplete fix for a previous vulnerability that mishandled argument escaping when executing batch files. Specifically, prior to Rust version 1.81.0, users could bypass the implemented mitigations if batch file names contained trailing whitespace or periods—characteristics that Windows ignores when parsing file paths. This flaw poses a risk when executing commands that utilize untrusted arguments and are directed towards batch scripts. Users are advised to upgrade to Rust version 1.81.0 or later to ensure that mitigations apply universally, regardless of trailing characters in the batch file name.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References