GHSA-655h-hg88-5qmf `xcb::Connection::connect_to_fd*` functions violate I/O safety
The Rust XCB library violates I/O safety by closing file descriptors it does not own, potentially causing use-after-close errors in applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-655h-hg88-5qmf?
GHSA-655h-hg88-5qmf is a vulnerability in xcb, published on 5 Aug 2025.
Official description
The API of xcb::Connection has constructors which allow an arbitrary RawFd
to be used as a socket connection. On either failure of these constructors or
on the drop of Connection, it closes the associated file descriptor. Thus, a
program which uses an OwnedFd (such as a UnixStream) as the file descriptor
can close the file descriptor and continue to attempt using it or close an
already-closed file descriptor, violating I/O safety.
Starting in version 1.6.0, xcb provides Connection::connect_with_fd and
Connection::connect_with_fd_and_extensions as safe alternatives and
deprecates the problematic functions.
Which versions are affected by GHSA-655h-hg88-5qmf?
3 open source packages ship an affected version, including xcb.
| Package | Affected | Fixed in |
|---|---|---|
xcb crates.io | All versions | 1.6.0 |
xcb crates.io | All versions | 1.6.0 |
xcb crates.io | From 0.0.0-0 | 1.6.0 |
How do I fix GHSA-655h-hg88-5qmf?
Upgrade xcb to 1.6.0 or later.
Is GHSA-655h-hg88-5qmf being exploited?
There is no known exploitation of GHSA-655h-hg88-5qmf in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0051.