# GHSA-4q83-7cq4-p6wg: `tokio::io::ReadHalf<T>::unsplit` is Unsound

> GHSA-4q83-7cq4-p6wg is a low-severity vulnerability in tokio (crates.io). Affected versions: >= 1.21.0, < 1.24.2; >= 1.19.0, < 1.20.4; >= 0.2.0, < 1.18.5. It is fixed in 1.24.2, 1.20.4 or 1.18.5, depending on the release line.

Canonical page: https://cveminer.com/vulnerabilities/GHSA-4q83-7cq4-p6wg

| Field | Value |
| --- | --- |
| GHSA | GHSA-4q83-7cq4-p6wg |
| Severity | Low |
| CISA KEV | Not listed |
| Published | 4 Feb 2023 |
| Modified | 4 Feb 2023 |

## Description

`tokio::io::ReadHalf<T>::unsplit` can violate the `Pin` contract

The soundness issue is described in the [tokio/issues#5372](https://github.com/tokio-rs/tokio/issues/5372)

Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)
is unusual, combined with the difficulty of making any arbitrary use-after-free
exploitable in Rust without doing a lot of careful alignment of data types in
the surrounding code.

The `tokio` feature `io-util` is also required to be enabled to trigger this
soundness issue.

Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e
and carllerche appropriately responding and fixing the soundness bug.

Tokio before 0.2.0 used `futures` 0.1 that did not have `Pin`, so it is not
affected by this issue.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| tokio | crates.io | `pkg:cargo/tokio` | >= 1.21.0, < 1.24.2; >= 1.19.0, < 1.20.4; >= 0.2.0, < 1.18.5 | 1.24.2, 1.20.4, 1.18.5 |

## Questions

**Does GHSA-4q83-7cq4-p6wg have a CVE ID?**

No CVE ID has been assigned to GHSA-4q83-7cq4-p6wg yet. It is tracked only as a GitHub advisory.

**Which versions are affected by GHSA-4q83-7cq4-p6wg?**

tokio (crates.io): >= 1.21.0, < 1.24.2; >= 1.19.0, < 1.20.4; >= 0.2.0, < 1.18.5.

**How do I fix GHSA-4q83-7cq4-p6wg?**

Upgrade to 1.24.2, 1.20.4 or 1.18.5, depending on the release line.

**What is the Package URL (PURL) for GHSA-4q83-7cq4-p6wg?**

The affected package's PURL is pkg:cargo/tokio.

## References

- https://github.com/advisories/GHSA-4q83-7cq4-p6wg (advisory)
- https://github.com/tokio-rs/tokio/issues/5372 (report)
- https://github.com/tokio-rs/tokio (package)
- https://rustsec.org/advisories/RUSTSEC-2023-0005.html

---

Source: CVEminer (https://cveminer.com/vulnerabilities/GHSA-4q83-7cq4-p6wg), compiled from OSV (GitHub advisory), GitHub Advisory Database. OSV and GitHub Advisory Database content is licensed CC BY 4.0.