{"answers":{"affected":"3 open source packages ship an affected version, including mio. It affects 2 products.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27308 exists.","fix":"Upgrade mio to 0.8.11 or later.","what":"CVE-2024-27308 is a high-severity use after free vulnerability in tokio-rs mio, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-27308 and fix it if it is affected.\n\nWhat it is: CVE-2024-27308 is a high-severity use after free vulnerability in tokio-rs mio, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27308 exists.\n\nAffected packages and fixed versions:\n- mio (crates.io): affected from 0.7.2; fixed in 0.8.11\n- mio (crates.io): affected from 0.7.2; fixed in 0.8.11\n- mio (crates.io): affected from 0.7.2; fixed in 0.8.11\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-27308/ (Markdown: https://insights.sbomify.com/CVE-2024-27308/index.md)","id":"CVE-2024-27308","markdown":"https://insights.sbomify.com/CVE-2024-27308/index.md","name":"CVE-2024-27308","record":{"aliases":["AZL-35748","AZL-61991","GHSA-r8w9-5wcg-vfj7","RUSTSEC-2024-0019"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Rust I/O library","requires_auth":"none","summary":"Attackers can trigger use-after-free in Tokio applications on Windows by exploiting invalid named pipe tokens in the Mio library.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"mio","vendor":"mio_project"},{"product":"tokio","vendor":"tokio"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-672","name":"Operation on a Resource after Expiration or Release"},{"id":"CWE-416","name":"Use After Free"}],"description":"Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. This vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. Vulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Mio's tokens for named pipes may be delivered after deregistration","id":"CVE-2024-27308","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"use_after_free","year":"2024"},"n_packages":3,"n_references":4,"next":{"headline":"Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode","id":"CVE-2024-27309"},"packages":[{"ecosystem":"crates.io","fixed":["0.8.11"],"introduced":["0.7.2"],"last_affected":[],"package":"mio","purl":null,"source":"GHSA-r8w9-5wcg-vfj7"},{"ecosystem":"crates.io","fixed":["0.8.11"],"introduced":["0.7.2"],"last_affected":[],"package":"mio","purl":"pkg:cargo/mio","source":"GHSA-r8w9-5wcg-vfj7"},{"ecosystem":"crates.io","fixed":["0.8.11"],"introduced":["0.7.2"],"last_affected":[],"package":"mio","purl":"pkg:cargo/mio","source":"RUSTSEC-2024-0019"}],"prev":{"headline":"JSONata expression can pollute the \"Object\" prototype","id":"CVE-2024-27307"},"products":["mio"],"published":"2024-03-06","related":[{"cvss_score":5.5,"headline":"mio invalidly assumes the memory layout of std::net::SocketAddr","id":"CVE-2020-35922","kev_date_added":null,"published":"2020-12-31"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-27","vendors":["tokio-rs"]},"summary":"Attackers can trigger use-after-free in Tokio applications on Windows by exploiting invalid named pipe tokens in the Mio library.","url":"https://insights.sbomify.com/CVE-2024-27308/"}