RUSTSEC-2026-0386: `AsyncFd::new` and related constructors violate I/O safety

Open
  • Is something wrong?
#35 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
42/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
rust
Domain
backend, security

Research direction

Start by reviewing the Tokio advisory and linked pull request #8587 to identify which dependency or usage in this repository is affected; the issue does not name repository files or tests. Check the Tokio version and AsyncFd usage, then verify the chosen update or migration removes the reported unsoundness and passes the relevant checks.

Written by the indexing model from the issue text.

Description

AsyncFd::new and related constructors violate I/O safety

Details
Status unsound
Package tokio
Version 1.52.3
URL https://github.com/tokio-rs/tokio/pull/8587
Date 2026-10-13

tokio::io::unix::AsyncFd provides safe constructors (new, with_interest, try_new, and try_with_interest) that accept any T: AsRawFd rather than requiring proof of ownership or validity of the file descriptor. Because RawFd implements AsRawFd, safe code can construct an AsyncFd from an arbitrary or closed file descriptor, or close/replace the underlying file descriptor while the AsyncFd is still alive.

This violates I/O safety in two ways:

  1. AsyncFd<T> implements AsFd for all T: AsRawFd by calling BorrowedFd::borrow_raw(self.as_raw_fd()), allowing safe code to obtain an arbitrary BorrowedFd<'_> without owning the file descriptor.
  2. Tokio's I/O driver stores a pointer to an internal allocation in the epoll/kqueue user data for registered file descriptors. If the underlying file descriptor is duplicated and then closed while an AsyncFd is alive, and the OS reuses that file descriptor number for a another IO resource on the same runtime, dropping the first AsyncFd deregisters the reused file descriptor number and frees the first while the original file description remains registered in epoll, leading to a use-after-free when a readiness event fires.

Starting in Tokio 1.51.6, 1.53.3, and 1.54.0, AsyncFd::new, AsyncFd::with_interest, AsyncFd::try_new, and AsyncFd::try_with_interest are deprecated in favor of the unsafe constructors AsyncFd::register and AsyncFd::register_with_interest. Callers must ensure that the file descriptor remains valid, open, and unchanged for the lifetime of the AsyncFd.

See advisory page for additional details.

Dominant language
Rust
Stars
0
Forks
2
Avg merge
14d 2h
Merged PRs (30d)
1

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from stackabletech/postgresql-trino-gateway

All issues in stackabletech/postgresql-trino-gateway

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.