GHSA-rr8g-9fpq-6wmg Tokio broadcast channel calls clone in parallel, but does not require `Sync`
Unsoundness in Rust broadcast channels allows memory corruption when cloning non-Sync values, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-rr8g-9fpq-6wmg?
GHSA-rr8g-9fpq-6wmg is a memory corruption vulnerability in tokio, published on 7 Apr 2025.
Official description
The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.
Thank you to Austin Bonander for finding and reporting this issue.
Which versions are affected by GHSA-rr8g-9fpq-6wmg?
7 open source packages ship an affected version, including tokio.
| Package | Affected | Fixed in |
|---|---|---|
tokio crates.io | From 0.2.5 | 1.38.2, 1.42.1, 1.43.1, 1.44.2 |
tokio crates.io | From 0.2.5 | 1.38.2 |
tokio crates.io | From 0.2.5 | 1.38.2 |
tokio crates.io | From 1.39.0 | 1.43.1 |
tokio crates.io | From 1.39.0 | 1.43.1 |
tokio crates.io | From 1.44.0 | 1.44.2 |
1 more packages
tokio crates.io | From 1.44.0 | 1.44.2 |
How do I fix GHSA-rr8g-9fpq-6wmg?
Upgrade tokio to a fixed version for your release line: 1.38.2, 1.42.1, 1.43.1 or 1.44.2.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-rr8g-9fpq-6wmg being exploited?
There is no known exploitation of GHSA-rr8g-9fpq-6wmg in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0023.