RUSTSEC-2026-0384: Race condition in `tokio::time::Interval` on Tokio v1.54.0

Aperta
  • Qualcosa non va?
#326 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
1/5
Tempo stimato
Meno di un'ora
Idoneità per principianti
20/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
backend

Direzione di ricerca

The issue reports a Tokio vulnerability and links to its fix at tokio-rs/tokio#8692, but it does not identify a change needed in numtracker. First check the project's Tokio dependency and whether it can use a patched version (>=1.54.1); done means numtracker no longer depends on the affected 1.54.0 release.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Race condition in tokio::time::Interval on Tokio v1.54.0

Details
Package tokio
Version 1.54.0
URL https://github.com/tokio-rs/tokio/pull/8692
Date 2026-10-21
Patched versions >=1.54.1
Unaffected versions <1.54.0

Summary

On the multi-threaded runtime, there is a race condition between Interval::poll_tick and the runtime's time driver.

This affects Interval only. Sleep and Timeout are not affected.

Details

In Tokio v1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.

This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.

Impact

This may lead to crashes and use-after-frees in applications using Interval on a multi-threaded runtime.

Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.

Credits

Thank you to creepycode and carabistouille for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.

See advisory page for additional details.

Lingua principale
Rust
Stelle
2
Fork
2
Merge medio
13h 13m
PR unite (30g)
5

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di DiamondLightSource/numtracker

Tutte le issue di DiamondLightSource/numtracker

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.