-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe core vulnerability stems directly from the unsplit implementation in ReadHalf. The function's ability to move a !Unpin type T after it has been pinned (through async operations) violates Rust's Pin contract. This is explicitly demonstrated in the provided example where unsplit leads to use-after-free. The GitHub issue and advisory both specifically call out this function as the source of unsoundness, and the fix involved adding T: Unpin constraints to prevent this scenario.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tokio | rust | >= 1.21.0, < 1.24.2 | 1.24.2 |
| tokio | rust | >= 1.19.0, < 1.20.4 | 1.20.4 |
| tokio | rust | >= 0.2.0, < 1.18.5 | 1.18.5 |