[Security] Bump tokio from 1.20.1 to 1.20.4
Bumps tokio from 1.20.1 to 1.20.4. This update includes security fixes.
Vulnerabilities fixed
Tokio reject_remote_clients configuration may get dropped when creating a Windows named pipe
Impact
When configuring a Windows named pipe server, setting
pipe_mode
will resetreject_remote_clients
tofalse
. If the application has previously configuredreject_remote_clients
totrue
, this effectively undoes the configuration. This also applies ifreject_remote_clients
is not explicitly set as this is the default configuration and is cleared by callingpipe_mode
.Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publically shared folder (SMB).
Patches
The following versions have been patched:
- 1.23.1
- 1.20.3
- 1.18.4
The fix will also be present in all releases starting from version 1.24.0.
Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected.
Workarounds
Ensure that
pipe_mode
is set first after initializing aServerOptions
. For example:
... (truncated)
Patched versions: 1.20.3 Affected versions: >= 1.19.0, < 1.20.3
tokio::io::ReadHalf<T>::unsplit
is Unsoundtokio::io::ReadHalf<T>::unsplit
can violate thePin
contractThe soundness issue is described in the tokio/issues#5372
Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf) is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust without doing a lot of careful alignment of data types in the surrounding code.
The
tokio
featureio-util
is also required to be enabled to trigger this soundness issue.Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e and carllerche appropriately responding and fixing the soundness bug.
Tokio before 0.2.0 used
futures
0.1 that did not havePin
, so it is not affected by this issue.Patched versions: 1.20.4 Affected versions: >= 1.19.0, < 1.20.4
Release notes
Sourced from tokio's releases.
Tokio v1.20.2
1.20.2 (September 27, 2022)
This release removes the dependency on the
once_cell
crate to restore the MSRV of the 1.20.x LTS release. (#5048)
Commits
-
f3ce29a
chore: prepare Tokio v1.20.4 release -
0d8fe5f
Merge branch 'tokio-1.18.x' into tokio-1.20.x -
171ce0f
chore: prepare Tokio v1.18.5 release -
d6ea7a7
AddT: Unpin
bound to ReadHalf::unsplit -
ba81945
chore: prepare Tokio 1.20.3 release -
763bdc9
ci: run WASI tasks using latest Rust -
9f98535
Merge remote-tracking branch 'origin/tokio-1.18.x' into fix-named-pipes-1.20 -
9241c3e
chore: prepare Tokio v1.18.4 release -
699573d
net: fix named pipes server configuration builder -
3d95a46
chore: prepare Tokio v1.20.2 (#5055) - Additional commits viewable in compare view
Dependabot commands
You can trigger Dependabot actions by commenting on this MR
-
$dependabot rebase
will rebase this MR -
$dependabot recreate
will recreate this MR rewriting all the manual changes and resolving conflicts