PT-2023-18518 · Tokio · Tokio

Carllerche + 1 · Published 2023-01-04 · Updated 2023-01-11 · CVE-2023-22466

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tokio versions 1.7.0 through 1.18.3 Tokio versions 1.18.4 through 1.20.2 Tokio versions 1.20.3 through 1.23.0

Description When configuring a Windows named pipe server, setting pipe mode will reset reject remote clients to false. If the application has previously configured reject remote clients to true, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB).

Recommendations For versions 1.7.0 through 1.18.3, ensure that pipe mode is set first after initializing a ServerOptions. For versions 1.18.4 through 1.20.2, ensure that pipe mode is set first after initializing a ServerOptions. For versions 1.20.3 through 1.23.0, ensure that pipe mode is set first after initializing a ServerOptions. Update to version 1.24.0 or later to resolve the issue.

Exploit

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2023-22466

GHSA-7RRJ-XR53-82P7

RUSTSEC-2023-0001

Affected Products

Tokio

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22466.json · Exploit
• https://github.com/tokio-rs/tokio/pull/5336 · Patch
• https://ubuntu.com/security/CVE-2023-22466 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-22466 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22466 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2023-0001 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22466 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-22466 · Security Note
• https://osv.dev/vulnerability/GHSA-7rrj-xr53-82p7 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22466 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22466 · Vendor Advisory
• https://github.com/tokio-rs/tokio · Note
• https://github.com/tokio-rs/tokio/releases/tag/tokio-1.23.1 · Note
• https://github.com/tokio-rs/tokio/security/advisories/GHSA-7rrj-xr53-82p7 · Note
• https://t.me/cibsecurity/55922 · Telegram Post