from https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html

The Rust Security Response WG was notified that the std::fs::remove_dir_all standard library function is vulnerable to a race condition enabling symlink following (CWE-363). An attacker could use this security issue to trick a privileged program into deleting files and directories the attacker couldn't otherwise access or delete.

This issue has been assigned CVE-2022-21658.

https://www.cve.org/CVERecord?id=CVE-2022-21658
https://nvd.nist.gov/vuln/detail/CVE-2022-21658

affected versions

Rust 1.0.0 through Rust 1.58.0 is affected by this vulnerability. We're going to release Rust 1.58.1 later today, which will include mitigations for this vulnerability. Patches to the Rust standard library are also available for custom-built Rust toolchains here.

looks like patched version 1.58.1 is not released yet (https://github.com/rust-lang/rust/releases). Above blogpost also mentions this patch https://github.com/rust-lang/wg-security-response/tree/master/patches/CVE-2022-21658

mitigations

We recommend everyone to update to Rust 1.58.1 as soon as possible, especially people developing programs expected to run in privileged contexts (including system daemons and setuid binaries), as those have the highest risk of being affected by this.

Note that adding checks in your codebase before calling remove_dir_all will not mitigate the vulnerability, as they would also be vulnerable to race conditions like remove_dir_all itself. The existing mitigation is working as intended outside of race conditions.