GHSA-655h-hg88-5qmf RUSTSEC-2025-0051
Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety
Description
The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd (such as a UnixStream) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.
Starting in version 1.6.0, xcb provides Connection::connect_with_fd and Connection::connect_with_fd_and_extensions as safe alternatives and deprecates the problematic functions.
Affected versions
crates.io
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
xcb crates.io → 1.6.0
- cargo
cargo update -p xcb --precise 1.6.0
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Unreported
Weakness
CWE-666: Operation on Resource in Wrong Phase of Lifetime
The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.
How to prevent it
- Architecture and Design: Follow the resource's lifecycle from creation to release.
CWE-672: Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
References
Packages
Other links
- github.com/rust-x-bindings/rust-xcb/issues/167
- github.com/rust-x-bindings/rust-xcb/issues/282
- github.com/rust-x-bindings/rust-xcb/pull/283
- github.com/rustsec/advisory-db/pull/2355
- github.com/rust-x-bindings/rust-xcb/commit/da830976870c1174e3b33eb0643177be3991…
- rustsec.org/advisories/RUSTSEC-2025-0051.html
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-2xpg-3hx4-fm9r Out of bounds read in xcb | Critical | Also affects xcb |
| GHSA-c8hq-x4mm-p6q6 Memory handling issues in xcb | Medium | Also affects xcb |
| GHSA-m65r-rprj-r5rg Russh: Channel-scoped server callbacks can be reached without an open channel | Medium | Same weakness, CWE-666 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor