Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

RUSTSEC-2026-0384: Race condition in `tokio::time::Interval` on Tokio v1.54.0

Aperta
  • Qualcosa non va?
#1,369 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@szokeasaurusrex ci sta già lavorando.

Dal 27/10/2026.

  • #1370 di @szokeasaurusrex — aperta

Valutazione

Difficoltà
1/5
Tempo stimato
Meno di un'ora
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
backend

Direzione di ricerca

The issue identifies a Tokio v1.54.0 race in Interval::poll_tick on the multi-threaded runtime and links the fix in Tokio PR #8692. Read that pull request and check whether sentry-rust uses the affected Tokio version; done means the project is not exposed to the vulnerable version. If a dependency change is needed, inspect the relevant dependency declaration and verify the resolved version.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Rust

Race condition in tokio::time::Interval on Tokio v1.54.0

Details
Package tokio
Version 1.54.0
URL https://github.com/tokio-rs/tokio/pull/8692
Date 2026-10-21
Patched versions >=1.54.1
Unaffected versions <1.54.0

Summary

On the multi-threaded runtime, there is a race condition between Interval::poll_tick and the runtime's time driver.

This affects Interval only. Sleep and Timeout are not affected.

Details

In Tokio v1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.

This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.

Impact

This may lead to crashes and use-after-frees in applications using Interval on a multi-threaded runtime.

Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.

Credits

Thank you to creepycode and carabistouille for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.

See advisory page for additional details.

Lingua principale
Rust
Stelle
753
Fork
193
Merge medio
10h 10m
PR unite (30g)
5

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di getsentry/sentry-rust

Tutte le issue di getsentry/sentry-rust

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.