CVE-2023-22466 is a medium-severity vulnerability affecting Tokio, a Rust runtime, specifically versions 1.7.0 through 1.18.3, 1.19.0 through 1.20.2, and 1.21.0 through 1.23.0. It allows remote clients to access Windows named pipe servers if the pipe's associated path is on a publicly shared folder, due to an unintended reset of the reject_remote_clients setting when pipe_mode is configured. The CVSS score is 5.4 (MEDIUM) with an attack vector of network, low attack complexity, and potential for low impact on confidentiality and integrity. There is no evidence of active exploitation, public exploit code, or significant community discussion. Patches are available in Tokio versions 1.18.4, 1.20.3, 1.23.1, and all releases from 1.24.0 onwards.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.7.0, < 1.18.4CPE matchmatch criteria | cpe:2.3:a:tokio:tokio:*:*:*:*:*:rust:*:* | ||
>= 1.19.0, < 1.20.3CPE matchmatch criteria | cpe:2.3:a:tokio:tokio:*:*:*:*:*:rust:*:* | ||
>= 1.21.0, < 1.23.1CPE matchmatch criteria | cpe:2.3:a:tokio:tokio:*:*:*:*:*:rust:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2023-22466
Jun 11, 2024Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe
Jan 10, 2023Tokio reject_remote_clients configuration may get dropped when creating a Windows named pipe
Jan 6, 2023