Log in Start free

Vulnerability · Published Jan 4, 2023 · Assigned by GitHub_M

CVE-2023-22466Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe

Medium 5.4

In plain English

A medium-severity security flaw in tokio from tokio-rs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.6%top 50.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the application has previously configured `reject_remote_clients` to `true`, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that `pipe_mode` is set first after initializing a `ServerOptions`.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rust-tokio1.24.2-1DEBIAN-CVE-2023-22466
Debian:13rust-tokio1.24.2-1DEBIAN-CVE-2023-22466
Debian:14rust-tokio1.24.2-1DEBIAN-CVE-2023-22466
Ubuntu:22.04:LTSrust-tokiono fix listedUBUNTU-CVE-2023-22466

Affected products (as reported)

VendorProductVersions
tokio-rs tokio >= 1.7.0, < 1.18.4>= 1.19.0, < 1.20.3>= 1.21.0, < 1.23.1

Weakness: CWE-665 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

References