CVE-2023-22466CWE-665

Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe

Medium · published January 4, 2023

CVSS v3.1
5.4
EPSS
1%
Percentile
47.6
In the wild
Unconfirmed
What it is

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the application has previously configured `reject_remote_clients` to `true`, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that `pipe_mode` is set first after initializing a `ServerOptions`.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00590 · 47.6th percentile
Weakness
CWE-665 · Improper Initialization
Published
2023-01-04T21:47Z
EPSS history
Timeline
  • 04 JAN 21:47Z
    Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe
    cvelistv5