CVE-2021-38191: Race condition in tokio

August 25, 2021 (updated June 13, 2023)

When aborting a task with JoinHandle::abort, the future is dropped in the thread calling abort if the task is not currently being executed. This is incorrect for tasks spawned on a LocalSet. This can easily result in race conditions as many projects use Rc or RefCell in their Tokio tasks for better performance.

References

github.com/advisories/GHSA-2grh-hm3w-w7hv
github.com/tokio-rs/tokio
github.com/tokio-rs/tokio/issues/3929
nvd.nist.gov/vuln/detail/CVE-2021-38191
raw.githubusercontent.com/rustsec/advisory-db/main/crates/tokio/RUSTSEC-2021-0072.md
rustsec.org/advisories/RUSTSEC-2021-0072.html

Code Behaviors & Features

Detect and mitigate CVE-2021-38191 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →