Mio's tokens for named pipes may be delivered after deregistration
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. This vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. Vulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tokio-rs | mio | 0.7.2 to before 0.8.11 | 0.8.11 | Patch available | CNA |
| — | mio (crates.io) | 0.7.2 to before 0.8.11 | 0.8.11 | Patch available | GHSA-r8w9-5wcg-vfj7 |
- mio Vendortokio-rs Affected 0.7.2 to before 0.8.11 Fixed in 0.8.11 Patch available CNA
- mio (crates.io) Vendor— Affected 0.7.2 to before 0.8.11 Fixed in 0.8.11 Patch available GHSA-r8w9-5wcg-vfj7
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mio_project:mio:*:*:*:*:*:rust:*:* | 0.7.2 – 0.8.10 | Vulnerable | Mio Project |
| cpe:2.3:a:tokio:tokio:*:*:*:*:*:rust:*:* | 1.30.0 | Vulnerable | Tokio |
- cpe:2.3:a:mio_project:mio:*:*:*:*:*:rust:*:* Versions 0.7.2 – 0.8.10 Vulnerable ·Mio Project
- cpe:2.3:a:tokio:tokio:*:*:*:*:*:rust:*:* Versions 1.30.0 Vulnerable ·Tokio
Remediation
- Fix · CNA mio (tokio-rs) Fixed in 0.8.11
- Fix · GHSA-r8w9-5wcg-vfj7 mio (crates.io) Fixed in 0.8.11 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27308
- 2026-10-03 Alias added: GHSA-r8w9-5wcg-vfj7
References
Advisory 2
More tokio-rs vulnerabilities
- TI-2026-20650 Bytes is vulnerable to integer overflow in BytesMut::reserve CVSS 4.0MEDIUM 5.5
- TI-2022-02967 DoS in axum-core due to missing request size limit CVSS 3.1HIGH 7.5
- TI-2026-79968 Race condition in Tokio time Interval can cause use-after-free CVSS 4.0MEDIUM 5.8
- TI-2023-08715 Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe CVSS 3.1MEDIUM 5.4
- TI-2025-34841 slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check CVSS 4.0MEDIUM 5.1
- TI-2025-35976 Tracing logging user input may result in poisoning logs with ANSI escape sequences CVSS 4.0LOW 2.3
Sources
- CVE-2024-27308 · CVE Program
- CVE-2024-27308 · NVD
- FIRST EPSS
- GHSA-r8w9-5wcg-vfj7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences