Skip to content
Fencer Intel
low —

GHSA-4q83-7cq4-p6wg json

`tokio::io::ReadHalf<T>::unsplit` is Unsound

published 3y ago modified 2mo ago also RUSTSEC-2023-0005

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

`tokio::io::ReadHalf<T>::unsplit` can violate the `Pin` contract

The soundness issue is described in the [tokio/issues#5372](https://github.com/tokio-rs/tokio/issues/5372)

Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf) is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust without doing a lot of careful alignment of data types in the surrounding code.

The `tokio` feature `io-util` is also required to be enabled to trigger this soundness issue.

Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e and carllerche appropriately responding and fixing the soundness bug.

Tokio before 0.2.0 used `futures` 0.1 that did not have `Pin`, so it is not affected by this issue.

Patch / fix

  • crates.io tokio 1.18.5, 1.20.4, 1.24.2

Is GHSA-4q83-7cq4-p6wg in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io tokio
>=1.21.0, <1.24.2
>=1.19.0, <1.20.4
>=0.2.0, <1.18.5
1.24.2
1.20.4
1.18.5

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.