# CVE-2024-27308: Mio's tokens for named pipes may be delivered after deregistration

> Attackers can trigger use-after-free in Tokio applications on Windows by exploiting invalid named pipe tokens in the Mio library.

- **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 6 Mar 2024
- **Updated:** 27 Aug 2024
- **Also known as:** AZL-35748, AZL-61991, GHSA-r8w9-5wcg-vfj7, RUSTSEC-2024-0019

## What is CVE-2024-27308?

CVE-2024-27308 is a high-severity use after free vulnerability in tokio-rs mio, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. This vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. Vulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens.

Weakness: CWE-672 (Operation on a Resource after Expiration or Release), CWE-416 (Use After Free)

## Which versions are affected by CVE-2024-27308?

3 open source packages ship an affected version, including mio. It affects 2 products.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `mio` | crates.io | From 0.7.2 | 0.8.11 |
| `mio` | crates.io | From 0.7.2 | 0.8.11 |
| `mio` | crates.io | From 0.7.2 | 0.8.11 |

Products: Mio Project Mio, Tokio Tokio.

## How do I fix CVE-2024-27308?

Upgrade mio to 0.8.11 or later.

## Is CVE-2024-27308 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27308 exists.

## Other vulnerabilities in tokio-rs mio

- [CVE-2020-35922](https://insights.sbomify.com/CVE-2020-35922/): mio invalidly assumes the memory layout of std::net::SocketAddr (medium 5.5)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2024-27308 and fix it if it is affected.

What it is: CVE-2024-27308 is a high-severity use after free vulnerability in tokio-rs mio, published on 6 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27308 exists.

Affected packages and fixed versions:
- mio (crates.io): affected from 0.7.2; fixed in 0.8.11
- mio (crates.io): affected from 0.7.2; fixed in 0.8.11
- mio (crates.io): affected from 0.7.2; fixed in 0.8.11

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2024-27308/ (Markdown: https://insights.sbomify.com/CVE-2024-27308/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2024-27308
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-27308
- OSV: https://osv.dev/vulnerability/CVE-2024-27308

---
From sbomify Insights: https://insights.sbomify.com/CVE-2024-27308/
Summaries are generated and may contain mistakes; the official description above is the record.