Skip to content
Log inStart free trial

GHSA-7rrj-xr53-82p7 CVE-2023-22466 RUSTSEC-2023-0001

Tokio reject_remote_clients configuration may get dropped when creating a Windows named pipe

Medium crates.io
Severity
5.4 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.59%
Chance of exploitation in the next 30 days. Higher than 48.23% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-665 Improper Initialization
Fix
1.18.4
Upgrade tokio to this version or later

Description

Impact

When configuring a Windows named pipe server, setting pipe_mode will reset reject_remote_clients to false. If the application has previously configured reject_remote_clients to true, this effectively undoes the configuration. This also applies if reject_remote_clients is not explicitly set as this is the default configuration and is cleared by calling pipe_mode.

Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publically shared folder (SMB).

Patches

The following versions have been patched:

  • 1.23.1
  • 1.20.3
  • 1.18.4

The fix will also be present in all releases starting from version 1.24.0.

Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

References

https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients

Affected versions

crates.io

PackageVulnerableFixed in
tokio
>= 1.7.0, < 1.18.4
1.18.4
tokio
>= 1.19.0, < 1.20.3
1.20.3
tokio
>= 1.21.0, < 1.23.1
1.23.1
tokio
>= 1.7.0, < 1.18.4
>= 1.19.0, < 1.20.3
>= 1.21.0, < 1.23.1
1.18.4
1.20.3
1.23.1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

tokio crates.io → 1.18.4

cargo
cargo update -p tokio --precise 1.18.4

Severity breakdown

CVSS 3.1 5.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Weakness

CWE-665: Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

How to prevent it
  • Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
  • Architecture and Design: Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
  • Implementation: Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
  • Implementation: Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
  • Implementation: Avoid race conditions (CWE-362) during initialization routines.
  • Build and Compilation: Run or compile your product with settings that generate warnings about uninitialized variables or data.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-5wjr-9356-4wc8
Tokio: Race condition in `tokio::time::Interval`
Medium Also affects tokio
RUSTSEC-2026-0386
`AsyncFd::new` and related constructors violate I/O safety
Not rated yet Also affects tokio
GHSA-rr8g-9fpq-6wmg
Tokio broadcast channel calls clone in parallel, but does not require `Sync`
Low Also affects tokio
GHSA-4q83-7cq4-p6wg
`tokio::io::ReadHalf<T>::unsplit` is Unsound
Low Also affects tokio
RUSTSEC-2021-0124
Race Condition in tokio
High Also affects tokio
RUSTSEC-2021-0072
Race condition in tokio
Medium Also affects tokio
GHSA-cmwh-pvxp-8882
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
Medium Same weakness, CWE-665
GHSA-2fqr-mr3j-6wp8
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
High Same weakness, CWE-665
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor