github.com
https://github.com/tokio-rs/tokio CVE-2021-38191
MEDIUM
Race condition in tokio
Record summary
CVE-2021-38191 has a selected CVSS score of 5.9 (medium).
Description
An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.
Description source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| GitHub Advisory | 1.8.0 to < 1.8.1 · Fixed in 1.8.1 | affected | |
| 1.7.0 to < 1.7.2 · Fixed in 1.7.2 | affected | ||
| 1.6.0 to < 1.6.3 · Fixed in 1.6.3 | affected | ||
| 0.3.0 to < 1.5.1 · Fixed in 1.5.1 | affected |
References
5github.com
https://github.com/tokio-rs/tokio/issues/3929 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-38191 raw.githubusercontent.com
https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tokio/RUSTSEC-2021-0072.md rustsec.org
https://rustsec.org/advisories/RUSTSEC-2021-0072.html