-
Notifications
You must be signed in to change notification settings - Fork 0
Update Rust crate tokio to v1.38.2 [SECURITY] #37
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
82bac3b
to
49234d1
Compare
49234d1
to
83ab5bd
Compare
83ab5bd
to
6f20fab
Compare
6f20fab
to
fccc82c
Compare
fccc82c
to
6a26cb4
Compare
6a26cb4
to
9536fe9
Compare
9536fe9
to
0080721
Compare
c964c10
to
290e88d
Compare
290e88d
to
bf5f18b
Compare
025a5be
to
c5a34c5
Compare
5c0a6d4
to
5583a78
Compare
5583a78
to
eef4033
Compare
eef4033
to
617270c
Compare
617270c
to
293665e
Compare
293665e
to
fd9f904
Compare
fd9f904
to
4d2acfc
Compare
4d2acfc
to
9e92c84
Compare
9e92c84
to
26629d5
Compare
26629d5
to
221e7e5
Compare
221e7e5
to
c408d4f
Compare
c408d4f
to
52bc594
Compare
52bc594
to
4d9c969
Compare
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: Cargo.lock
|
4d9c969
to
3c8dc65
Compare
|
3c8dc65
to
df76a95
Compare
This PR contains the following updates:
1.23.0
->1.38.2
GitHub Vulnerability Alerts
CVE-2023-22466
Impact
When configuring a Windows named pipe server, setting
pipe_mode
will resetreject_remote_clients
tofalse
. If the application has previously configuredreject_remote_clients
totrue
, this effectively undoes the configuration. This also applies ifreject_remote_clients
is not explicitly set as this is the default configuration and is cleared by callingpipe_mode
.Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publically shared folder (SMB).
Patches
The following versions have been patched:
The fix will also be present in all releases starting from version 1.24.0.
Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected.
Workarounds
Ensure that
pipe_mode
is set first after initializing aServerOptions
. For example:References
https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients
GHSA-4q83-7cq4-p6wg
tokio::io::ReadHalf<T>::unsplit
can violate thePin
contractThe soundness issue is described in the tokio/issues#5372
Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)
is unusual, combined with the difficulty of making any arbitrary use-after-free
exploitable in Rust without doing a lot of careful alignment of data types in
the surrounding code.
The
tokio
featureio-util
is also required to be enabled to trigger thissoundness issue.
Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e
and carllerche appropriately responding and fixing the soundness bug.
Tokio before 0.2.0 used
futures
0.1 that did not havePin
, so it is notaffected by this issue.
GHSA-rr8g-9fpq-6wmg
The broadcast channel internally calls
clone
on the stored value when receiving it, and only requiresT:Send
. This means that using the broadcast channel with values that areSend
but notSync
can trigger unsoundness if theclone
implementation makes use of the value being!Sync
.Thank you to Austin Bonander for finding and reporting this issue.
Release Notes
tokio-rs/tokio (tokio)
v1.38.2
: Tokio v1.38.2Compare Source
This release fixes a soundness issue in the broadcast channel. The channel accepts values that are
Send
but!Sync
. Previously, the channel calledclone()
on these values without synchronizing. This release fixes the channel by synchronizing calls to.clone()
(Thanks Austin Bonander for finding and reporting the issue).Fixed
clone()
call in broadcast channel (#7232)v1.38.1
: Tokio v1.38.1Compare Source
1.38.1 (July 16th, 2024)
This release fixes the bug identified as (#6682), which caused timers not
to fire when they should.
Fixed
wake_up
while holding all the locks of sharded time wheels (#6683)v1.38.0
: Tokio v1.38.0Compare Source
This release marks the beginning of stabilization for runtime metrics. It
stabilizes
RuntimeMetrics::worker_count
. Future releases will continue tostabilize more metrics.
Added
File::create_new
(#6573)copy_bidirectional_with_sizes
(#6500)AsyncBufRead
forJoin
(#6449)Clone
forNamedPipeInfo
(#6586)Notify::notify_last
(#6520)mpsc::Receiver::{capacity,max_capacity}
(#6511)split
method to the semaphore permit (#6472, #6478)tokio::task::join_set::Builder::spawn_blocking
(#6578)Changed
#[tokio::test]
append#[test]
at the end of the attribute list (#6497)blocking_threads
count (#6551)RuntimeMetrics::worker_count
(#6556)lifo_slot
inblock_in_place
(#6596)global_queue_interval
is zero (#6445)Semaphore
for task dumps (#6499)LocalKey::get
work with Clone types (#6433)true_when
field inTimerShared
(#6563)Fixed
Interval::poll_tick
(#6487)is_empty
on mpsc block boundaries (#6603)Documented
stdin
documentation (#6581)ReadHalf::unsplit()
documentation (#6498)select!
(#6468)NamedPipeServer
example (#6590)SemaphorePermit
,OwnedSemaphorePermit
(#6477)Barrier::wait
is not cancel safe (#6494)watch::Sender::{subscribe,closed}
(#6490)spawn_blocking
tasks (#6571)LocalSet::run_until
(#6599)v1.37.0
: Tokio v1.37.0Compare Source
1.37.0 (March 28th, 2024)
Added
set_max_buf_size
totokio::fs::File
(#6411)try_new
andtry_with_interest
toAsyncFd
(#6345)forget_permits
method to semaphore (#6331)is_closed
,is_empty
, andlen
to mpsc receivers (#6348)rwlock()
method to ownedRwLock
guards (#6418)Clone
forwatch::Sender
(#6388)TaskLocalFuture::take_value
(#6340)FromIterator
forJoinSet
(#6300)Changed
io::split
use a mutex instead of a spinlock (#6403)Fixed
Documented
AsyncBufReadExt::fill_buf
(#6431)AsyncReadExt
's primitive read functions (#6337)Runtime
to#[tokio::main]
(#6366)enter
example deterministic (#6351)mpsc::Sender::downgrade
with#[must_use]
(#6326)const_new
beforenew_with
(#6392)Changed (unstable)
Id
in taskdumps (#6328)unhandled_panic
is enabled when not supported (#6410)v1.36.0
: Tokio v1.36.0Compare Source
1.36.0 (February 2nd, 2024)
Added
tokio::io::Join
(#6220)AsyncWrite
forEmpty
(#6235)UnixSocket
(#6290)TcpSocket
(#6311){Receiver,UnboundedReceiver}::poll_recv_many
(#6236)Sender::{try_,}reserve_many
(#6205)watch::Receiver::mark_unchanged
(#6252)JoinSet::try_join_next
(#6280)Changed
copy
cooperative (#6265)repeat
andsink
cooperative (#6254)Documented
clear_ready
docs (#6304)*Fd
traits onTcpSocket
are unix-only (#6294)tokio::sync::Mutex
(#6279)v1.35.1
: Tokio v1.35.1Compare Source
1.35.1 (December 19, 2023)
This is a forward part of a change that was backported to 1.25.3.
Fixed
tokio::runtime::io::registration::async_io
(#6221)v1.35.0
: Tokio v1.35.0Compare Source
1.35.0 (December 8th, 2023)
Added
Changed
Sized
requirements fromAsyncReadExt.read_buf
(#6169)Runtime
unwind safe (#6189)Fixed
--cfg docsrs
work without net feature (#6166)unsync_load
on miri (#6179)Documented
AsyncWriteExt
examples (#6149)LocalSet::run_until
(#6147)v1.34.0
: Tokio v1.34.0Compare Source
Fixed
clear_readiness
after io driver shutdown (#6067)take
(#6080)broadcast::channel
link (#6100)Changed
::core
qualified imports instead of::std
insidetokio::test
macro (#5973)Added
fs::read_dir
to includeaix
(#6075)mpsc::Receiver::recv_many
(#6010)v1.33.0
: Tokio v1.33.0Compare Source
1.33.0 (October 9, 2023)
Fixed
Interest::add
with#[must_use]
(#6037)watch::Receiver::wait_for
(#6021)spawn_local
source location (#5984)Changed
watch
(#6018)Added
tokio::fs::File
(#5958)Interest::remove
method (#5906)DuplexStream
(#5985)?Sized
bound to{MutexGuard,OwnedMutexGuard}::map
(#5997)watch::Receiver::mark_unseen
(#5962, #6014, #6017)watch::Sender::new
(#5998)OnceCell::from_value
(#5903)Removed
stats
feature (#5952)Documented
Child::wait
is cancel safe (#5977)Semaphore
(#5939, #5956, #5978, #6031, #6032, #6050)broadcast
capacity is a lower bound (#6042)const_new
is not instrumented (#6002)mpsc::Sender::send
(#5947)watch
channel (#5954)Unstable
v1.32.1
: Tokio v1.32.1Compare Source
1.32.1 (December 19, 2023)
This is a forward part of a change that was backported to 1.25.3.
Fixed
tokio::runtime::io::registration::async_io
(#6221)v1.32.0
: Tokio v1.32.0Compare Source
Fixed
broadcast::Receiver
(#5925)Added
Command::raw_arg
(#5930)Unstable
v1.31.0
: Tokio v1.31.0Compare Source
Fixed
WriteHalf::poll_write_vectored
(#5914)Unstable
v1.30.0
: Tokio v1.30.0Compare Source
1.30.0 (August 9, 2023)
This release bumps the MSRV of Tokio to 1.63. (#5887)
Changed
--cfg mio_unsupported_force_poll_poll
flag (#5881)const_new
methods always available (#5885)Added
broadcast::Sender::new
(#5824)UCred
for espidf (#5868)File::options()
(#5869)Interval
(#5878){ChildStd*}::into_owned_{fd, handle}
(#5899)Removed
tokio_*
cfgs (#5890)Documented
broadcast::send
(#5820)AsyncReadExt::read_exact
(#5863)Sleep
as!Unpin
in docs (#5916)raw_arg
not showing up in docs (#5865)Unstable
v1.29.1
: Tokio v1.29.1Compare Source
Fixed
block_in_place
with ablock_on
between (#5837)v1.29.0
: Tokio v1.29.0Compare Source
Technically a breaking change, the
Send
implementation is removed fromruntime::EnterGuard
. This change fixes a bug and should not impact most users.Breaking
EnterGuard
should not beSend
(#5766)Fixed
fs::read_dir
(#5653)JoinSet
(#5693)EnterGuard
dropped incorrect order (#5772)File
(#5803)Changed
Added
broadcast::Receiver::blocking_recv
(#5690)raw_arg
method toCommand
(#5704)JoinSet::poll_join_next
(#5721)Unstable
v1.28.2
: Tokio v1.28.2Compare Source
1.28.2 (May 28, 2023)
Forward ports 1.18.6 changes.
Fixed
v1.28.1
: Tokio v1.28.1Compare Source
1.28.1 (May 10th, 2023)
This release fixes a mistake in the build script that makes
AsFd
implementations unavailable on Rust 1.63. (#5677)v1.28.0
: Tokio v1.28.0Compare Source
1.28.0 (April 25th, 2023)
Added
AsyncFd::async_io
(#5542)recv_buf
forUdpSocket
andUnixDatagram
(#5583)OwnedSemaphorePermit::semaphore
(#5618)same_channel
to broadcast channel (#5607)watch::Receiver::wait_for
(#5611)JoinSet::spawn_blocking
andJoinSet::spawn_blocking_on
(#5612)Changed
read_to_end
not grow unnecessarily (#5610)RwLock
(#5647)Notify
(#5503)Fixed
get_peer_cred
on AIX (#5065)broadcast
with custom wakers (#5578)Documented
Semaphore::MAX_PERMITS
(#5645)tokio::sync::watch::Sender
docs (#5587)v1.27.0
: Tokio v1.27.0Compare Source
1.27.0 (March 27th, 2023)
This release bumps the MSRV of Tokio to 1.56. (#5559)
Added
async_io
helper method to sockets (#5512)AsFd
/AsHandle
/AsSocket
(#5514, #5540)UdpSocket::peek_sender()
(#5520)RwLockWriteGuard::{downgrade_map, try_downgrade_map}
(#5527)JoinHandle::abort_handle
(#5543)Changed
memchr
fromlibc
(#5558)#[tokio::main]
(#5557)Interval
returnsReady
(#5553)Fixed
ReadDir
(#5555)spawn_blocking
location fields (#5573)Wheel::poll()
(#5574)Documented
tokio::io::copy[_buf]
(#5575)ReaderStream
andStreamReader
in module docs (#5576)v1.26.0
: Tokio v1.26.0Compare Source
Fixed
join!
andtry_join!
([https://github.com/tokio-rs/tokio/pull/5504])Added
fs::try_exists
([https://github.com/tokio-rs/tokio/pull/4299])MappedOwnedMutexGuard
([https://github.com/tokio-rs/tokio/pull/5474])Changed
#[clippy::has_significant_drop]
([https://github.com/tokio-rs/tokio/pull/5422])Instant::now()
perf with test-util ([https://github.com/tokio-rs/tokio/pull/5513])Internal Changes
poll_fn
incopy_bidirectional
([https://github.com/tokio-rs/tokio/pull/5486])notify_waiters
calls atomic ([https://github.com/tokio-rs/tokio/pull/5458])Unstable
Documented
blocking_*
methods ([https://github.com/tokio-rs/tokio/pull/5448])process::Command
docs ([https://github.com/tokio-rs/tokio/pull/5413])v1.25.3
: Tokio v1.25.3Compare Source
1.25.3 (December 17th, 2023)
Fixed
tokio::runtime::io::registration::async_io
(#6221)v1.25.2
: Tokio v1.25.2Compare Source
1.25.2 (September 22, 2023)
Forward ports 1.20.6 changes.
Changed
memchr
fromlibc
(#5960)v1.25.1
: Tokio v1.25.1Compare Source
1.25.1 (May 28, 2023)
Forward ports 1.18.6 changes.
Fixed
v1.25.0
: Tokio v1.25.01.25.0 (January 28, 2023)
Fixed
Added
broadcast::Sender::len
(#5343)Changed
v1.24.1
: Tokio v1.24.1Compare Source
This release fixes a compilation failure on targets without
AtomicU64
when using rustc older than 1.63. (#5356)v1.24.0
: Tokio v1.24.0Compare Source
The highlight of this release is the reduction of lock contention for all I/O operations (#5300). We have received reports of up to a 20% improvement in CPU utilization and increased throughput for real-world I/O heavy applications.
Fixed
AtomicU64
support detection (#5284)Added
per tick (#5186)
threads per runtime instance (#4250)
Changed
read_dir()
by chunking operations (#5309)ThreadId
implementation (#5329)spawn_blocking
task is running (#5115)v1.23.1
: Tokio v1.23.1Compare Source
This release forward ports changes from 1.18.4.
Fixed
pipe mode (#5336).
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.