CVE-2023-22466
Description
Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting pipe_mode will reset reject_remote_clients to false. If the application has previously configured reject_remote_clients to true, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that pipe_mode is set first after initializing a ServerOptions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tokiocrates.io | >= 1.7.0, < 1.18.4 | 1.18.4 |
tokiocrates.io | >= 1.19.0, < 1.20.3 | 1.20.3 |
tokiocrates.io | >= 1.21.0, < 1.23.1 | 1.23.1 |
Affected products
4- osv-coords3 versions
< 0.1.5-r5+ 2 more
- (no CPE)range: < 0.1.5-r5
- (no CPE)range: < 0.1.5-r5
- (no CPE)range: >= 1.7.0, < 1.18.4
Patches
Vulnerability mechanics
References
7- github.com/tokio-rs/tokio/pull/5336nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-7rrj-xr53-82p7ghsaADVISORY
- github.com/tokio-rs/tokio/releases/tag/tokio-1.23.1nvdRelease NotesThird Party AdvisoryWEB
- github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7nvdMitigationThird Party AdvisoryWEB
- learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipeanvdTechnical DescriptionThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-22466ghsaADVISORY
- rustsec.org/advisories/RUSTSEC-2023-0001.htmlghsaWEB
News mentions
0No linked articles in our index yet.