An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.
Mend Note: Converted from WS-2021-0424, on 2022-11-07.
CVE-2021-45710 - High Severity Vulnerability
tokio-0.2.13.crate
An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.
Library home page: https://crates.io/api/v1/crates/tokio/0.2.13/download
Path to dependency file: /third_party/rust_crates/vendor/h2/Cargo.toml
Path to vulnerable library: /third_party/rust_crates/vendor/h2/Cargo.toml,/third_party/rust_crates/vendor/hyper/Cargo.toml
Dependency Hierarchy: - :x: **tokio-0.2.13.crate** (Vulnerable Library)
tokio-0.2.21.crate
An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.
Library home page: https://crates.io/api/v1/crates/tokio/0.2.21/download
Path to dependency file: /third_party/rust_crates/Cargo.toml
Path to vulnerable library: /third_party/rust_crates/Cargo.toml
Dependency Hierarchy: - :x: **tokio-0.2.21.crate** (Vulnerable Library)
tokio-0.2.11.crate
An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.
Library home page: https://crates.io/api/v1/crates/tokio/0.2.11/download
Path to dependency file: /third_party/rust_crates/vendor/hyper-rustls/Cargo.toml
Path to vulnerable library: /third_party/rust_crates/vendor/hyper-rustls/Cargo.toml
Dependency Hierarchy: - :x: **tokio-0.2.11.crate** (Vulnerable Library)
tokio-0.2.9.crate
An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.
Library home page: https://crates.io/api/v1/crates/tokio/0.2.9/download
Path to dependency file: /third_party/rust_crates/vendor/trust-dns-resolver/Cargo.toml
Path to vulnerable library: /third_party/rust_crates/vendor/trust-dns-resolver/Cargo.toml
Dependency Hierarchy: - :x: **tokio-0.2.9.crate** (Vulnerable Library)
tokio-1.0.1.crate
An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.
Library home page: https://crates.io/api/v1/crates/tokio/1.0.1/download
Path to dependency file: /third_party/rust_crates/vendor/crossterm/Cargo.toml
Path to vulnerable library: /third_party/rust_crates/vendor/crossterm/Cargo.toml
Dependency Hierarchy: - :x: **tokio-1.0.1.crate** (Vulnerable Library)
Found in base branch: master
An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption. Mend Note: Converted from WS-2021-0424, on 2022-11-07.
Publish Date: 2021-12-26
URL: CVE-2021-45710
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://rustsec.org/advisories/RUSTSEC-2021-0124.html
Release Date: 2021-12-27
Fix Resolution: tokio - 1.8.4,1.13.1
Step up your Open Source Security Game with Mend here