~ / search / GHSA-2grh-hm3w-w7hv

GHSA-2grh-hm3w-w7hv

Race condition in tokio

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-38191

Packages

EcosystemPackageAffectedFixed in
crates.io tokio >= 1.8.0, < 1.8.1 1.8.1
crates.io tokio >= 1.7.0, < 1.7.2 1.7.2
crates.io tokio >= 1.6.0, < 1.6.3 1.6.3
crates.io tokio >= 0.3.0, < 1.5.1 1.5.1

Details

As written in the advisory (Markdown source, shown as plain text).

When aborting a task with JoinHandle::abort, the future is dropped in the thread calling abort if the task is not currently being executed. This is incorrect for tasks spawned on a LocalSet. This can easily result in race conditions as many projects use Rc or RefCell in their Tokio tasks for better performance.

References

External links from the advisory. They lead to third-party sites.