—

RUSTSEC-2021-0072

Task dropped in wrong thread when aborting `LocalSet` task

Details

When aborting a task with `JoinHandle::abort`, the future is dropped in the thread calling abort if the task is not currently being executed. This is incorrect for tasks spawned on a `LocalSet`.

This can easily result in race conditions as many projects use `Rc` or `RefCell` in their Tokio tasks for better performance.

See [tokio#3929][issue] for more details.

[issue]: https://github.com/tokio-rs/tokio/issues/3929

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/tokio

Introduced in: 0.3.0Fixed in: 1.5.1

Upgrade tokio to 1.5.1 or newer (ecosystem crates.io).

References

https://crates.io/crates/tokio[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2021-0072.html[ADVISORY]
https://github.com/tokio-rs/tokio/issues/3929[REPORT]