chore(deps): update rust crate tokio to 1.51.6 [security] #13
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/crate-tokio-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
1→1.51.61→1.51.61.27.0→1.51.6Tokio broadcast channel calls clone in parallel, but does not require
SyncGHSA-rr8g-9fpq-6wmg / RUSTSEC-2025-0023
More information
Details
The broadcast channel internally calls
cloneon the stored value when receiving it, and only requiresT:Send. This means that using the broadcast channel with values that areSendbut notSynccan trigger unsoundness if thecloneimplementation makes use of the value being!Sync.Thank you to Austin Bonander for finding and reporting this issue.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Broadcast channel calls clone in parallel, but does not require
SyncGHSA-rr8g-9fpq-6wmg / RUSTSEC-2025-0023
More information
Details
The broadcast channel internally calls
cloneon the stored value whenreceiving it, and only requires
T:Send. This means that using the broadcastchannel with values that are
Sendbut notSynccan trigger unsoundness ifthe
cloneimplementation makes use of the value being!Sync.Thank you to Austin Bonander for finding and reporting this issue.
Severity
Unknown
References
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
AsyncFd::newand related constructors violate I/O safetyRUSTSEC-2026-0386
More information
Details
tokio::io::unix::AsyncFdprovides safe constructors (new,with_interest,try_new, andtry_with_interest) that accept anyT: AsRawFdrather than requiring proof of ownership or validity of the file descriptor. BecauseRawFdimplementsAsRawFd, safe code can construct anAsyncFdfrom an arbitrary or closed file descriptor, or close/replace the underlying file descriptor while theAsyncFdis still alive.This violates I/O safety in two ways:
AsyncFd<T>implementsAsFdfor allT: AsRawFdby callingBorrowedFd::borrow_raw(self.as_raw_fd()), allowing safe code to obtain an arbitraryBorrowedFd<'_>without owning the file descriptor.epoll/kqueueuser data for registered file descriptors. If the underlying file descriptor is duplicated and then closed while anAsyncFdis alive, and the OS reuses that file descriptor number for a another IO resource on the same runtime, dropping the firstAsyncFdderegisters the reused file descriptor number and frees the first while the original file description remains registered inepoll, leading to a use-after-free when a readiness event fires.Starting in Tokio 1.51.6, 1.53.3, and 1.54.0,
AsyncFd::new,AsyncFd::with_interest,AsyncFd::try_new, andAsyncFd::try_with_interestare deprecated in favor of theunsafeconstructorsAsyncFd::registerandAsyncFd::register_with_interest. Callers must ensure that the file descriptor remains valid, open, and unchanged for the lifetime of theAsyncFd.Severity
Unknown
References
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
Race condition in tokio
CVE-2021-38191 / GHSA-2grh-hm3w-w7hv / RUSTSEC-2021-0072
More information
Details
When aborting a task with JoinHandle::abort, the future is dropped in the thread calling abort if the task is not currently being executed. This is incorrect for tasks spawned on a LocalSet. This can easily result in race conditions as many projects use Rc or RefCell in their Tokio tasks for better performance.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Task dropped in wrong thread when aborting
LocalSettaskCVE-2021-38191 / GHSA-2grh-hm3w-w7hv / RUSTSEC-2021-0072
More information
Details
When aborting a task with
JoinHandle::abort, the future is dropped in thethread calling abort if the task is not currently being executed. This is
incorrect for tasks spawned on a
LocalSet.This can easily result in race conditions as many projects use
RcorRefCellin their Tokio tasks for better performance.
See tokio#3929 for more details.
Severity
Unknown
References
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
Race Condition in tokio
CVE-2021-45710 / GHSA-fg7r-2g4j-5cgr / RUSTSEC-2021-0124
More information
Details
If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.
When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.
Note that the race only occurs when both halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Data race when sending and receiving after closing a
oneshotchannelCVE-2021-45710 / GHSA-fg7r-2g4j-5cgr / RUSTSEC-2021-0124
More information
Details
If a
tokio::sync::oneshotchannel is closed (via theoneshot::Receiver::closemethod), a data race may occur if theoneshot::Sender::sendmethod is called while the correspondingoneshot::Receiverisawaited or callingtry_recv.When these methods are called concurrently on a closed channel, the two halves
of the channel can concurrently access a shared memory location, resulting in a
data race. This has been observed to cause memory corruption.
Note that the race only occurs when both halves of the channel are used
after the
Receiverhalf has calledclose. Code wherecloseis not used, or where theReceiveris notawaited andtry_recvis not called after callingclose,is not affected.
See tokio#4225 for more details.
Severity
Unknown
References
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
tokio::io::ReadHalf<T>::unsplitis UnsoundGHSA-4q83-7cq4-p6wg / RUSTSEC-2023-0005
More information
Details
tokio::io::ReadHalf<T>::unsplitcan violate thePincontractThe soundness issue is described in the tokio/issues#5372
Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)
is unusual, combined with the difficulty of making any arbitrary use-after-free
exploitable in Rust without doing a lot of careful alignment of data types in
the surrounding code.
The
tokiofeatureio-utilis also required to be enabled to trigger thissoundness issue.
Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e
and carllerche appropriately responding and fixing the soundness bug.
Tokio before 0.2.0 used
futures0.1 that did not havePin, so it is notaffected by this issue.
Severity
Low
References
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
tokio::io::ReadHalf<T>::unsplitis UnsoundGHSA-4q83-7cq4-p6wg / RUSTSEC-2023-0005
More information
Details
tokio::io::ReadHalf<T>::unsplitcan violate thePincontractThe soundness issue is described in the tokio/issues#5372
Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)
is unusual, combined with the difficulty of making any arbitrary use-after-free
exploitable in Rust without doing a lot of careful alignment of data types in
the surrounding code.
The
tokiofeatureio-utilis also required to be enabled to trigger thissoundness issue.
Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e
and carllerche appropriately responding and fixing the soundness bug.
Tokio before 0.2.0 used
futures0.1 that did not havePin, so it is notaffected by this issue.
Severity
Unknown
References
This data is provided by OSV and the Rust Advisory Database (CC0 1.0).
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate.
chore(deps): update rust crate tokio to 1.38.2 [security]to chore(deps): update rust crate tokio to 1.51.6 [security]c01771f9ffto0bd6a24f72View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.