N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-rr8g-9fpq-6wmg

GHSA-rr8g-9fpq-6wmg: Tokio broadcast channel calls clone in parallel, but does not require `Sync`

The broadcast channel internally calls clone on the stored value when receiving it, and only requires T:Send. This means that using the broadcast channel with values that are Send but not Sync can trigger unsoundness if the clone implementation makes use of the value being !Sync.

Thank you to Austin Bonander for finding and reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-rr8g-9fpq-6wmg

GHSA-rr8g-9fpq-6wmg:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tokio	rust	>= 1.44.0, < 1.44.2	1.44.2
tokio	rust	>= 0.2.5, < 1.38.2	1.38.2
tokio	rust	>= 1.39.0, < 1.43.1	1.43.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability arises from the broadcast channel calling T::clone() on received values which are Send but not necessarily Sync, without ensuring that the clone operation itself is synchronized if T::clone() is not thread-safe for concurrent calls. This could lead to data races.

The primary commit fixing this is 4b174ce2c95fe1d1a217917db93fcc935e17e0da. The analysis of this commit reveals:

The clone() operation on the received value T happens within the tokio::sync::broadcast::RecvGuard::clone_value method. The way this method accessed the value (previously through UnsafeCell::with on a field of a struct guarded by RwLockReadGuard) was changed.
The synchronization primitive for accessing shared channel Slots was changed from RwLock to Mutex. This change is evident in tokio::sync::broadcast::Receiver::recv_priv where the lock is acquired (self.shared.buffer[idx].read().unwrap() became self.shared.buffer[idx].lock()), and also in Sender::send and Sender::new.

The function tokio::sync::broadcast::RecvGuard::clone_value is where the potentially unsynchronized clone occurred. The function tokio::sync::broadcast::Receiver::recv_priv is where the insufficient locking (RwLock) was performed, setting up the conditions for the unsafe clone. The patch addresses this by changing to a Mutex, ensuring exclusive access to the Slot during the clone operation.

Therefore, these two functions are identified as critical. RecvGuard::clone_value is where the vulnerable operation (the clone itself) is performed, and Receiver::recv_priv is where the flawed synchronization strategy (that permitted the vulnerability) was implemented and subsequently fixed. Public API functions like Receiver::recv and Receiver::try_recv would call recv_priv and thus be part of an exploit's call stack.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.