RUSTSEC-2026-0538: Receive loop can spin after a truncated datagram

Abierto
  • ¿Algo no está bien?
#39 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
Menos de una hora
Aptitud para principiantes
50/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
rust
Área
security

Línea de trabajo

The advisory concerns the quinn-udp crate pinned at 0.5.14 in this project's dependency graph. Start by finding its entry in the lockfile and checking whether it comes in directly or through another crate. Update it to a patched version (0.5.16 or later on the 0.5 line, or 0.6.3 or later on the 0.6 line), then build and run the test suite to confirm it resolves cleanly. Done when the lockfile shows a patched version and the build and tests pass.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Receive loop can spin after a truncated datagram

Details
Package quinn-udp
Version 0.5.14
URL https://github.com/quinn-rs/quinn/commit/462865a6c33039c26076f7077c7cd7e2f997b9cd
Date 2026-09-30
Patched versions >=0.5.16, <0.6.0,>=0.6.3

Some targets read one datagram per recvmsg call instead of using recvmmsg: Apple platforms without the fast-apple-datapath feature, OpenBSD, NetBSD, Solaris and illumos, and from 0.6 also DragonFly BSD, Redox and GNU/Hurd. On these targets the receive loop set up its msghdr only once and looked at the MSG_TRUNC flag before checking whether recvmsg had failed. After a datagram larger than the receive buffer was dropped, a following EAGAIN still saw the old truncation flag. The loop then kept issuing non-blocking receives instead of returning WouldBlock.

When the receive buffer is smaller than a datagram that arrives, a remote sender can keep the task that drives the socket busy, before any QUIC packet authentication. The loop ends only when a later datagram fits in the buffer. Whether an application is exposed therefore depends on the receive buffer size it uses. Linux, Android, FreeBSD and Windows use other receive paths and are not affected.

The fix rebuilds the header before every recvmsg call and returns receive errors before checking the truncation flag. It is in 0.5.16 and 0.6.3.

See advisory page for additional details.

Lenguaje dominante
Rust
Estrellas
0
Forks
2
Merge medio
14 d 2 h
PR fusionados (30 d)
1

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de stackabletech/postgresql-trino-gateway

Todos los issues de stackabletech/postgresql-trino-gateway

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.