RUSTSEC-2026-0384: Race condition in `tokio::time::Interval` on Tokio v1.54.0
维护者通常 1 天内回复
已经有一个关联 PR 被合并了。
- #1370 来自 @szokeasaurusrex —— 已合并
评估
调研方向
The issue identifies a Tokio v1.54.0 race in Interval::poll_tick on the multi-threaded runtime and links the fix in Tokio PR #8692. Read that pull request and check whether sentry-rust uses the affected Tokio version; done means the project is not exposed to the vulnerable version. If a dependency change is needed, inspect the relevant dependency declaration and verify the resolved version.
由索引模型根据 Issue 内容生成。
描述
Race condition in
tokio::time::Intervalon Tokio v1.54.0
| Details | |
|---|---|
| Package | tokio |
| Version | 1.54.0 |
| URL | https://github.com/tokio-rs/tokio/pull/8692 |
| Date | 2026-10-21 |
| Patched versions | >=1.54.1 |
| Unaffected versions | <1.54.0 |
Summary
On the multi-threaded runtime, there is a race condition between Interval::poll_tick and the runtime's time driver.
This affects Interval only. Sleep and Timeout are not affected.
Details
In Tokio v1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.
This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.
Impact
This may lead to crashes and use-after-frees in applications using Interval on a multi-threaded runtime.
Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.
Credits
Thank you to creepycode and carabistouille for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.
See advisory page for additional details.
- 主要语言
- Rust
- 星标
- 753
- 派生
- 193
- 平均合并
- 4 天 9 小时
- 30 天内合并 PR
- 10
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
getsentry/sentry-rust 的其他 Issue
-
breaking change Rust Task
难度 2/5 1-3 小时 新手友好度 65/100
getsentry/sentry-rust#1345 · 1 条评论 ·
维护者通常 1 天内回复
-
Rust Task
难度 2/5 1-3 小时 新手友好度 62/100
getsentry/sentry-rust#933 · 1 条评论 ·
维护者通常 1 天内回复
-
Bug Rust
难度 4/5 3-5 天 新手友好度 45/100
getsentry/sentry-rust#1354 · 2 条评论 ·
维护者通常 1 天内回复
-
Rust Tracking Issue
难度 5/5 一周以上 新手友好度 25/100
getsentry/sentry-rust#1344 · 1 条评论 ·
维护者通常 1 天内回复
-
Rust Tracking Issue
难度 5/5 一周以上 新手友好度 25/100
getsentry/sentry-rust#1343 · 1 条评论 ·
维护者通常 1 天内回复
查看 getsentry/sentry-rust 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 65/100
-
难度 2/5 1-3 小时 新手友好度 72/100
mozilla-services/syncstorage-rs#2715 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 70/100
-
documentation
难度 1/5 1 小时以内 新手友好度 82/100
physicsdolphin/nv-uefi-unlocker#53 · 4 个 reaction ·
维护者通常 1 天内回复
-
area/desktop-shell
难度 2/5 1-3 小时 新手友好度 72/100
yantrikos/yantrik-os#1012 ·
维护者通常 1 天内回复