CVE-2021-45710: tokio Race Condition
CVSS: 8.1v3.1HighModified
AliasesSUSE-SU-2022:3996-1SUSE-SU-2022:4124-1UBUNTU-CVE-2021-45710DEBIAN-CVE-2021-45710openSUSE-SU-2024:11710-1openSUSE-SU-2024:11714-1openSUSE-SU-2024:11715-1openSUSE-SU-2024:11716-1openSUSE-SU-2024:11717-1openSUSE-SU-2024:11722-1openSUSE-SU-2024:11916-1CGA-4gv4-9q3r-jjx9GHSA-fg7r-2g4j-5cgrRUSTSEC-2021-0124
Published 26-12-2021Last modified 04-08-2024
Vulnerability summary
CVE-2021-45710 is a high (CVSS 8.1) Race Condition vulnerability in tokio. EPSS estimates a 1.24% chance of exploitation in the next 30 days, higher than 68.7% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.1 (NVD)EPSS score
1.24%
0%100%
Low · +0.08 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 26-12-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · Crates.ioEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 5.1Preferred score · NVD (NIST)
AV:N/AC:H/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.24%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
+0.08 pp
From 1.16% on 20-09-2026
20-09-202620-10-2026
EPSS score1.24%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Opensuse9 products
- 389-ds&distro=openSUSE Leap 15.3< 1.4.4.19~git59.136fc84-150300.3.27.1
- 389-ds&distro=openSUSE Leap 15.4< 2.0.16~git56.d15a0a7-150400.3.15.1
- greetd&distro=openSUSE Tumbleweed< 0.8.0-2.1
- rustscan&distro=openSUSE Tumbleweed< 2.0.1+0-1.1
- rustup&distro=openSUSE Tumbleweed< 1.24.3~git1.0a74fef5-2.1
Suse2 products
- 389-ds&distro=SUSE Linux Enterprise Module for Server Applications 15 SP3< 1.4.4.19~git59.136fc84-150300.3.27.1
- 389-ds&distro=SUSE Linux Enterprise Module for Server Applications 15 SP4< 2.0.16~git56.d15a0a7-150400.3.15.1
Chainguard1 product
- todaAll versions (No fix recorded) | < 0.3.0-r0
Crates.Io1 product
- tokio≥ 0.1.14, < 1.8.4 | ≥ 1.9.0, < 1.13.1
Debian1 product
- rust-tokio< 1.15.0-1
Tokio1 product
- tokio≥ 0.1.14, < 1.8.4 | ≥ 1.9.0, < 1.13.1
Ubuntu1 product
- rust-tokioAll versions (No fix recorded)
7 vendors · 16 products
References
16 links- rustsec.org/advisories/RUSTSEC-2021-0124.htmlX Refsource MISCREPORTFIXWEBAdvisoryPatchThird Party Advisory
- raw.githubusercontent.com/rustsec/advisory-db/main/crates/tokio/RUSTSEC-2021-0124.mdX Refsource MISCREPORTAdvisoryWEBThird Party Advisory
Show all 16 references
- github.com/tokio-rs/tokioPACKAGE
- crates.io/crates/tokioPACKAGE