Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The race caused a use-after-free on the timer's waker and task state in safe Rust, which could produce assertion panics, task reference-count corruption, or heap memory corruption.
This issue is fixed in 1.54.1.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
tokio-rs:tokio
References 6
https://github.com/tokio-rs/tokio/security/advisories/GHSA-5wjr-9356-4wc8
https://github.com/tokio-rs/tokio/security/advisories/GHSA-5wjr-9356-4wc8
https://github.com/tokio-rs/tokio/pull/8458
https://github.com/tokio-rs/tokio/pull/8458
https://github.com/tokio-rs/tokio/pull/8692
https://github.com/tokio-rs/tokio/pull/8692
https://github.com/tokio-rs/tokio/commit/2b4eba7833864c04ecd2f3e5f4a97ff4f6fa28…
https://github.com/tokio-rs/tokio/commit/2b4eba7833864c04ecd2f3e5f4a97ff4f6fa28d0
https://github.com/tokio-rs/tokio/commit/5ed619bbaba87357ee5103d71b75e7c84cad99…
https://github.com/tokio-rs/tokio/commit/5ed619bbaba87357ee5103d71b75e7c84cad99c9
https://github.com/tokio-rs/tokio/releases/tag/tokio-1.54.1
https://github.com/tokio-rs/tokio/releases/tag/tokio-1.54.1