RUSTSEC-2026-0386: `AsyncFd::new` and related constructors violate I/O safety
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
The issue describes an unsoundness report in Tokio's AsyncFd constructors, but does not identify any Wasmtime files or tests to change. Start by reading the linked Tokio pull request and advisory, then check whether Wasmtime uses the affected constructors. Done looks like a scoped response to the report based on that investigation.
由索引模型根据 Issue 内容生成。
描述
AsyncFd::newand related constructors violate I/O safety
| Details | |
|---|---|
| Status | unsound |
| Package | tokio |
| Version | 1.51.1 |
| URL | https://github.com/tokio-rs/tokio/pull/8587 |
| Date | 2026-10-13 |
tokio::io::unix::AsyncFd provides safe constructors (new, with_interest, try_new, and try_with_interest) that accept any T: AsRawFd rather than requiring proof of ownership or validity of the file descriptor. Because RawFd implements AsRawFd, safe code can construct an AsyncFd from an arbitrary or closed file descriptor, or close/replace the underlying file descriptor while the AsyncFd is still alive.
This violates I/O safety in two ways:
AsyncFd<T>implementsAsFdfor allT: AsRawFdby callingBorrowedFd::borrow_raw(self.as_raw_fd()), allowing safe code to obtain an arbitraryBorrowedFd<'_>without owning the file descriptor.- Tokio's I/O driver stores a pointer to an internal allocation in the
epoll/kqueueuser data for registered file descriptors. If the underlying file descriptor is duplicated and then closed while anAsyncFdis alive, and the OS reuses that file descriptor number for a another IO resource on the same runtime, dropping the firstAsyncFdderegisters the reused file descriptor number and frees the first while the original file description remains registered inepoll, leading to a use-after-free when a readiness event fires.
Starting in Tokio 1.51.6, 1.53.3, and 1.54.0, AsyncFd::new, AsyncFd::with_interest, AsyncFd::try_new, and AsyncFd::try_with_interest are deprecated in favor of the unsafe constructors AsyncFd::register and AsyncFd::register_with_interest. Callers must ensure that the file descriptor remains valid, open, and unchanged for the lifetime of the AsyncFd.
See advisory page for additional details.
- 主要语言
- Rust
- 星标
- 18.8k
- 派生
- 1.9k
- 平均合并
- 1 天 2 分钟
- 30 天内合并 PR
- 392
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
bytecodealliance/wasmtime 的其他 Issue
-
bug wasm-proposal:exceptions wasmtime:debugging
难度 2/5 1-3 小时 新手友好度 76/100
bytecodealliance/wasmtime#14102 ·
维护者通常 1 天内回复
-
wasm-proposal:gc
难度 2/5 1-3 小时 新手友好度 62/100
bytecodealliance/wasmtime#13808 · 2 条评论 ·
维护者通常 1 天内回复
-
bug
难度 4/5 3-5 天 新手友好度 24/100
bytecodealliance/wasmtime#15036 ·
维护者通常 1 天内回复
-
bug wasi-http
难度 3/5 1-2 天 新手友好度 32/100
bytecodealliance/wasmtime#15026 · 1 条评论 ·
维护者通常 1 天内回复
-
Compile-time builtin composition resolves guest imports from host working directory & has path failures可能已有人在做 @dyslexicsteak 于 1 天前认领。 未关闭bug
难度 5/5 一周以上 新手友好度 15/100
bytecodealliance/wasmtime#15024 ·
维护者通常 1 天内回复
查看 bytecodealliance/wasmtime 的全部 Issue
相似的 Issue
-
desktop documentation
难度 1/5 1 小时以内 新手友好度 90/100
vfarcic/dot-agent-deck#2008 ·
维护者通常 1 天内回复
-
needs triage
难度 1/5 1 小时以内 新手友好度 85/100
pbakaus/impeccable#1210 ·
维护者通常 1 天内回复
-
area: ci priority: P4 ready-for-agent
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
L: javascript
难度 2/5 1-3 小时 新手友好度 72/100
dependabot/dependabot-core#16744 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 68/100
nautechsystems/nautilus_trader#5486 · 1 条评论 ·
维护者通常 1 天内回复