GitHub Advisoryadvisory · crates.io

GHSA-rr8g-9fpq-6wmg Tokio broadcast channel calls clone in parallel, but does not require `Sync`

LOW Published 2025-04-07 Modified 2025-04-07 Official page ↗
Ecosystem
crates.io
Packages
tokio
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-664
Reviewed
2025-04-07

Affected packages

• crates.io tokio: >= 1.44.0, < 1.44.2 → fixed in 1.44.2 • crates.io tokio: >= 0.2.5, < 1.38.2 → fixed in 1.38.2 • crates.io tokio: >= 1.39.0, < 1.43.1 → fixed in 1.43.1

Description

The broadcast channel internally calls `clone` on the stored value when receiving it, and only requires `T:Send`. This means that using the broadcast channel with values that are `Send` but not `Sync` can trigger unsoundness if the `clone` implementation makes use of the value being `!Sync`. Thank you to Austin Bonander for finding and reporting this issue.

Related

Weakness · CWE (1)

  • CWE-664 Improper Control of a Resource Through its Lifetime weakness

References