RUSTSEC-2026-0384: Race condition in `tokio::time::Interval` on Tokio v1.54.0

Ouverte
  • Quelque chose ne va pas ?
#476 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
1/5
Temps estimé
Moins d'une heure
Accessibilité débutants
35/100
Type d'issue
Bug
Clarté
À clarifier
Activité
Active
Stack technique
rust
Domaine
security

Piste de recherche

The issue describes a Tokio timer race and links the fix at tokio-rs/tokio#8692, but it does not identify a stackablectl file or change to make. First check whether stackablectl uses Tokio 1.54.0 and whether that version can be affected; compare its dependency configuration with the advisory’s patched versions. Done means confirming the dependency is unaffected or updating it to a patched version.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Race condition in tokio::time::Interval on Tokio v1.54.0

Details
Package tokio
Version 1.54.0
URL https://github.com/tokio-rs/tokio/pull/8692
Date 2026-10-21
Patched versions >=1.54.1
Unaffected versions <1.54.0

Summary

On the multi-threaded runtime, there is a race condition between Interval::poll_tick and the runtime's time driver.

This affects Interval only. Sleep and Timeout are not affected.

Details

In Tokio v1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.

This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.

Impact

This may lead to crashes and use-after-frees in applications using Interval on a multi-threaded runtime.

Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.

Credits

Thank you to creepycode and carabistouille for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.

See advisory page for additional details.

Langage dominant
Rust
Étoiles
11
Forks
5
Merge moyen
1 j 6 h
PR mergées (30 j)
1

Préparer son environnement

  • Aucun Dockerfile ni fichier Docker Compose
  • Propose un modèle de pull request
  • Aucun guide de contribution

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de stackabletech/stackablectl

Toutes les issues de stackabletech/stackablectl

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.