CVE-2023-22466 Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe

What is CVE-2023-22466?

CVE-2023-22466 is a medium-severity vulnerability in tokio-rs tokio, published on 4 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the application has previously configured `reject_remote_clients` to `true`, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that `pipe_mode` is set first after initializing a `ServerOptions`.

Weakness: CWE-665

Which versions are affected by CVE-2023-22466?

7 open source packages ship an affected version, including tokio. It affects 1 product.

Products include Tokio Tokio.

How do I fix CVE-2023-22466?

Upgrade tokio to a fixed version for your release line: 1.20.3, 1.23.1 or 1.18.4.

Is CVE-2023-22466 being exploited?

There is no known exploitation of CVE-2023-22466 in the wild and no public exploit code.

Other vulnerabilities in tokio-rs tokio

• CVE-2021-45710 Race Condition in tokio High 8.1
• CVE-2021-38191 Race condition in tokio Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-22466, GHSA-7rrj-xr53-82p7, RUSTSEC-2023-0001, UBUNTU-CVE-2023-22466.