Tokio: Race condition in `tokio::time::Interval`
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 1.54.1
- Public exploit
- None on Exploit-DB
Summary
The Tokio runtime for Rust, specifically its `tokio::time::Interval` timer used with the multi-threaded runtime, is affected. A race condition can corrupt memory in safe Rust code, leading to crashes from assertion panics, corrupted task reference counts, or heap memory corruption.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The race caused a use-after-free on the timer's waker and task state in safe Rust, which could produce assertion panics, task reference-count corruption, or heap memory corruption. This issue is fixed in 1.54.1.
Affected versions
- tokio-rs tokio
1.54.0
- tokiocrates.io
From 1.54.0 · fixed in 1.54.1
- tokiocrates.io
From 1.54.0 · fixed in 1.54.1