CVE-2021-38191 Race condition in tokio
A race condition in the tokio crate allows tasks to be dropped on the wrong thread, potentially causing crashes or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-38191?
CVE-2021-38191 is a medium-severity vulnerability in n/a, published on 8 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.
Weakness: CWE-362
Which versions are affected by CVE-2021-38191?
9 open source packages ship an affected version, including tokio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tokio crates.io | From 0.3.0 | 1.5.1, 1.6.3, 1.7.2, 1.8.1 |
tokio crates.io | From 0.3.0 | 1.5.1 |
tokio crates.io | From 0.3.0 | 1.5.1 |
tokio crates.io | From 1.6.0 | 1.6.3 |
tokio crates.io | From 1.6.0 | 1.6.3 |
tokio crates.io | From 1.7.0 | 1.7.2 |
3 more packages
tokio crates.io | From 1.7.0 | 1.7.2 |
tokio crates.io | From 1.8.0 | 1.8.1 |
tokio crates.io | From 1.8.0 | 1.8.1 |
Products include Tokio Tokio.
How do I fix CVE-2021-38191?
Upgrade tokio to a fixed version for your release line: 1.5.1, 1.6.3, 1.7.2 or 1.8.1.
Is CVE-2021-38191 being exploited?
There is no known exploitation of CVE-2021-38191 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2grh-hm3w-w7hv, RUSTSEC-2021-0072.