PkgSeer

Vulnerability GHSA-rr8g-9fpq-6wmg

Low Risk

1 year ago

Tokio broadcast channel calls clone in parallel, but does not require `Sync`

0.2.5 - 1.38.1 and 1.39.0 - 1.43.0 and 1.44.0 - 1.44.1

Summary

Tokio broadcast channel calls clone in parallel, but does not require `Sync`

Details

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.

Thank you to Austin Bonander for finding and reporting this issue.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Broadcast channel calls clone in parallel, but does not require `Sync`

0.2.5 - 1.38.1 RUSTSEC-2025-0023

`tokio::io::ReadHalf<T>::unsplit` is Unsound

0.2.0 - 1.18.4 and 1.19.0 - 1.20.3 and 1.21.0 - 1.24.1 GHSA-4q83-7cq4-p6wg

`tokio::io::ReadHalf<T>::unsplit` is Unsound

0.2.0 - 1.18.4 RUSTSEC-2023-0005

Tokio reject_remote_clients configuration may get dropped when creating a Windows named pipe

1.7.0 - 1.18.3 and 1.19.0 - 1.20.2 and 1.21.0 - 1.23.0 GHSA-7rrj-xr53-82p7

reject_remote_clients Configuration corruption

1.7.0 - 1.18.3 RUSTSEC-2023-0001

View all vulnerabilities for these packages

Impacted packages

tokio

Timeline

Published

1 year ago

Fixed (1.38.2)

1 year ago

Fixed (1.43.1)

1 year ago

Fixed (1.44.2)

1 year ago

Last Modified

1 month ago