Read the docs
TI-2023-30682 Aliases GHSA-4q83-7cq4-p6wg

`tokio::io::ReadHalf<T>::unsplit` is Unsound

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

`tokio::io::ReadHalf<T>::unsplit` can violate the `Pin` contract The soundness issue is described in the [tokio/issues#5372](https://github.com/tokio-rs/tokio/issues/5372) Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf) is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust without doing a lot of careful alignment of data types in the surrounding code. The `tokio` feature `io-util` is also required to be enabled to trigger this soundness issue. Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e and carllerche appropriately responding and fixing the soundness bug. Tokio before 0.2.0 used `futures` 0.1 that did not have `Pin`, so it is not affected by this issue.

Why it matters now

Fix Fixed tokio (crates.io): 1.24.2, 1.20.4, 1.18.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—tokio (crates.io)1.21.0 to before 1.24.21.24.2Patch availableGHSA-4q83-7cq4-p6wg
—tokio (crates.io)1.19.0 to before 1.20.41.20.4Patch availableGHSA-4q83-7cq4-p6wg
—tokio (crates.io)0.2.0 to before 1.18.51.18.5Patch availableGHSA-4q83-7cq4-p6wg
  • tokio (crates.io) Vendor— Affected 1.21.0 to before 1.24.2 Fixed in 1.24.2 Patch available GHSA-4q83-7cq4-p6wg
  • tokio (crates.io) Vendor— Affected 1.19.0 to before 1.20.4 Fixed in 1.20.4 Patch available GHSA-4q83-7cq4-p6wg
  • tokio (crates.io) Vendor— Affected 0.2.0 to before 1.18.5 Fixed in 1.18.5 Patch available GHSA-4q83-7cq4-p6wg

Remediation

  • Fix · GHSA-4q83-7cq4-p6wg tokio (crates.io) Fixed in 1.24.2 Advisory →
  • Fix · GHSA-4q83-7cq4-p6wg tokio (crates.io) Fixed in 1.20.4 Advisory →
  • Fix · GHSA-4q83-7cq4-p6wg tokio (crates.io) Fixed in 1.18.5 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-4q83-7cq4-p6wg

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences