GHSA-655h-hg88-5qmf: Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety
(updated )
The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd (such as a UnixStream) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.
Starting in version 1.6.0, xcb provides Connection::connect_with_fd and Connection::connect_with_fd_and_extensions as safe alternatives and deprecates the problematic functions.
References
- github.com/advisories/GHSA-655h-hg88-5qmf
- github.com/rust-x-bindings/rust-xcb
- github.com/rust-x-bindings/rust-xcb/commit/da830976870c1174e3b33eb0643177be3991c002
- github.com/rust-x-bindings/rust-xcb/issues/167
- github.com/rust-x-bindings/rust-xcb/issues/282
- github.com/rust-x-bindings/rust-xcb/pull/283
- github.com/rustsec/advisory-db/pull/2355
- rustsec.org/advisories/RUSTSEC-2025-0051.html
Code Behaviors & Features
Detect and mitigate GHSA-655h-hg88-5qmf with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →