RUSTSEC-2020-0159: Potential segfault in localtime_r invocations

[github-actions]

Potential segfault in localtime_r invocations

Details
Package	chrono
Version	0.4.19
URL	chronotope/chrono#499
Date	2020-11-10

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

Workarounds

No workarounds are known.

References

• time-rs/time#293

See advisory page for additional details.

[hawkw]

Looks like we depend on chrono as a transitive dependency of several kube-rs crates:

:; cargo tree -p chrono -i
chrono v0.4.19
├── k8s-openapi v0.13.1
│   ├── kube v0.66.0
│   │   ├── linkerd-policy-controller v0.1.0 (/home/eliza/Code/linkerd2/policy-controller)
│   │   └── linkerd-policy-controller-k8s-api v0.1.0 (/home/eliza/Code/linkerd2/policy-controller/k8s/api)
│   │       ├── linkerd-policy-controller v0.1.0 (/home/eliza/Code/linkerd2/policy-controller)
│   │       └── linkerd-policy-controller-k8s-index v0.1.0 (/home/eliza/Code/linkerd2/policy-controller/k8s/index)
│   │           └── linkerd-policy-controller v0.1.0 (/home/eliza/Code/linkerd2/policy-controller)
│   ├── kube-client v0.66.0
│   │   ├── kube v0.66.0 (*)
│   │   └── kube-runtime v0.66.0
│   │       └── kube v0.66.0 (*)
│   ├── kube-core v0.66.0
│   │   ├── kube v0.66.0 (*)
│   │   └── kube-client v0.66.0 (*)
│   ├── kube-runtime v0.66.0 (*)
│   └── linkerd-policy-controller-k8s-api v0.1.0 (/home/eliza/Code/linkerd2/policy-controller/k8s/api) (*)
├── kube-client v0.66.0 (*)
└── kube-core v0.66.0 (*)

[olix0r]

Waiting on resolution of kube-rs/kube#650 kube-rs/kube#660

As far as we understand, this does not describe an exploitable vulnerability in Linkerd's runtime artifacts, as we don't expose any means to alter these environment variables at runtime.