The bug exists in all versions of libstd before today's, so in this case finding possibly affected Rust programs is easy: all of them. As for other situations:

The bug exists in all versions of libstd before today's, so in this case finding possibly affected Rust programs is easy: all of them. As for other situations: when Rust programs are built with Cargo, it creates a Cargo.lock file, which is a machine-readable record of all dependencies and their checksums used in the build. Distros could archive it and later use it track all affected dependencies. Unfortunately, libstd is a magical compiler built-in, not a regular dependency, so it doesn't get recorded that way.