Skip to content
OpenAdvisories
Medium · 5.4 CVE-2023-22466 EUVD-2023-0393GHSA-7rrj-xr53-82p7RUSTSEC-2023-0001

Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe

Published Jan 4, 2023 · Updated Mar 10, 2025 · Assigned by GitHub_M

Description

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the application has previously configured `reject_remote_clients` to `true`, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that `pipe_mode` is set first after initializing a `ServerOptions`.

Affected products

VendorProductAffectedFixed
tokio-rs tokio >= 1.7.0, < 1.18.4, >= 1.19.0, < 1.20.3, >= 1.21.0, < 1.23.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-tokio 1.24.2-1 —
Debian 13 rust-tokio 1.24.2-1 —
Debian 12 rust-tokio 1.24.2-1 —
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS rust-tokio No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling pulumi-watch 0.1.5-r5 —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io tokio >= 1.7.0, < 1.18.4 1.18.4 GHSA-7rrj-xr53-82p7
crates.io tokio >= 1.19.0, < 1.20.3 1.20.3 GHSA-7rrj-xr53-82p7
crates.io tokio >= 1.21.0, < 1.23.1 1.23.1 GHSA-7rrj-xr53-82p7
crates.io tokio >= 1.7.0, < 1.18.4 · >= 1.19.0, < 1.20.3 · >= 1.21.0, < 1.23.1 1.18.4, 1.20.3, 1.23.1 RUSTSEC-2023-0001

References