CVE-2021-38191

Vulnerability

An issue exists in the tokio crate (versions 0.3.0 up to but not including 1.8.1) where calling JoinHandle::abort on a task spawned within a LocalSet drops the associated future in the thread that invoked abort, rather than in the task's original runtime thread [1][3]. This violates thread-safety guarantees for !Send types such as Rc or RefCell [3][4]. The affected function is tokio::task::JoinHandle::abort, and the bug is present in all tokio versions from 0.3.0 until 1.8.0 inclusive [3].

Exploitation

An attacker (or a malicious local actor) who can control the thread from which JoinHandle::abort is called—for example, by spawning a helper thread that calls abort on a LocalSet task handle—can trigger the drop of a !Send future in an unintended thread [4]. The exploit relies on the fact that abort immediately drops the future if the task is not currently executing; when the task is on a LocalSet, that drop occurs in the caller's thread instead of the LocalSet's runtime thread [4]. The attacker must have the ability to call abort from a thread different from the LocalSet worker thread [4].

Impact

Successful exploitation causes a task's future (and any resources it holds) to be dropped in the wrong thread [1][3]. For !Send types like Rc or RefCell, this can lead to data races, undefined behavior, and memory corruption [3][4]. In practice, this undermines the safety guarantees provided by Rust's ownership and thread-safety model, potentially allowing memory unsafety in applications that rely on LocalSet for thread-local tasks [4].

Mitigation

The vulnerability is fixed in tokio versions 1.8.1, 1.7.2, 1.6.3, and 1.5.1 [3]. Users should upgrade to the latest patched version (≥1.8.1) for their major release line [3]. No workaround is available for unpatched versions; avoiding the use of JoinHandle::abort on LocalSet‑spawned tasks can prevent exploitation, but this is not a complete mitigation because other code paths may inadvertently trigger the abort [3]. The advisory is listed in the RustSec database (RUSTSEC-2021-0072) [3].