RUSTSEC-2023-0005: tokio::io::ReadHalf<T>::unsplit is Unsound
#3085
Assignees
Comments
|
This requires a major bump of actix-web, which will take a little doing. WIP in https://github.com/djmitche/taskwarrior/pull/new/issue3085. |
djmitche
added a commit
to djmitche/taskwarrior
that referenced
this issue
Apr 8, 2023
This avoids a vulnerability in tokio (GothenburgBitFactory#3085). The major version updates of both actix-web and actix-rt required some signficant changes. Chief among those, it turns out we were relying on actix-rt to run the HttpServer in a different thread from the rest of the test, so that we could talk to it from sync code in the test thread. This no longer works, so the sync code is now run in a dedicated thread with `actix_rt::task::spawn_blocking`.
djmitche
added a commit
that referenced
this issue
Apr 9, 2023
This avoids a vulnerability in tokio (#3085). The major version updates of both actix-web and actix-rt required some signficant changes. Chief among those, it turns out we were relying on actix-rt to run the HttpServer in a different thread from the rest of the test, so that we could talk to it from sync code in the test thread. This no longer works, so the sync code is now run in a dedicated thread with `actix_rt::task::spawn_blocking`.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
tokio0.2.25tokio::io::ReadHalf<T>::unsplitcan violate thePincontractThe soundness issue is described in the tokio/issues#5372
Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)
is unusual, combined with the difficulty of making any arbitrary use-after-free
exploitable in Rust without doing a lot of careful alignment of data types in
the surrounding code.
The
tokiofeatureio-utilis also required to be enabled to trigger thissoundness issue.
Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e
and carllerche appropriately responding and fixing the soundness bug.
Tokio before 0.2.0 used
futures0.1 that did not havePin, so it is notaffected by this issue.
See advisory page for additional details.
The text was updated successfully, but these errors were encountered: