Most recent entries from all

EUVD-2026-33537

fkie_cve-2021-45710

An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.

GHSA-fg7r-2g4j-5cgr — Race Condition in tokio

Affected: crates.io: tokio

If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.

When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.

Note that the race only occurs when both halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.

gsd-2021-45710

openSUSE-SU-2024:0294-1 — Security update for kanidm

Security update for kanidm

RUSTSEC-2021-0124 — Data race when sending and receiving after closing a `oneshot` channel

Affected: crates.io: tokio

If a `tokio::sync::oneshot` channel is closed (via the [`oneshot::Receiver::close`] method), a data race may occur if the `oneshot::Sender::send` method is called while the corresponding `oneshot::Receiver` is `await`ed or calling `try_recv`.

Note that the race only occurs when **both** halves of the channel are used after the `Receiver` half has called `close`. Code where `close` is not used, or where the `Receiver` is not `await`ed and `try_recv` is not called after calling `close`, is not affected.

See [tokio#4225][issue] for more details.

[corruption]: https://github.com/tokio-rs/tokio/issues/4225#issuecomment-967434847 [issue]: https://github.com/tokio-rs/tokio/issues/4225 [`oneshot::Receiver::close`]: https://docs.rs/tokio/1.14.0/tokio/sync/oneshot/struct.Receiver.html#method.close

SUSE-SU-2022:3949-1 — Security update for rustup

Security update for rustup

UBUNTU-CVE-2021-45710

Affected: Ubuntu:20.04:LTS: rust-tokio, Ubuntu:22.04:LTS: rust-tokio, Ubuntu:24.04:LTS: rust-tokio, Ubuntu:25.10: rust-tokio, Ubuntu:26.04:LTS: rust-tokio