GitHub Advisoryadvisory · crates.io

GHSA-2grh-hm3w-w7hv Race condition in tokio

MEDIUM Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2021-38191
Ecosystem
crates.io
Packages
tokio
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-362, CWE-366
Reviewed
2021-08-18

Affected packages

• crates.io tokio: >= 1.8.0, < 1.8.1 → fixed in 1.8.1 • crates.io tokio: >= 1.7.0, < 1.7.2 → fixed in 1.7.2 • crates.io tokio: >= 1.6.0, < 1.6.3 → fixed in 1.6.3 • crates.io tokio: >= 0.3.0, < 1.5.1 → fixed in 1.5.1

Description

When aborting a task with JoinHandle::abort, the future is dropped in the thread calling abort if the task is not currently being executed. This is incorrect for tasks spawned on a LocalSet. This can easily result in race conditions as many projects use Rc or RefCell in their Tokio tasks for better performance.

Related

Alias · CVE (1)

  • CVE-2021-38191 An issue was discovered in the tokio crate before 1.8.1 for Rust. vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-366 Race Condition within a Thread weakness

References