CVE-2024-27308

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Mar 6, 2024
CWE ID 672
CWE ID 416

Summary

CVE-2024-27308 is a vulnerability in the Mio Metal I/O library for Rust. This vulnerability affects versions of Mio between v0.7.2 and v0.8.10. When using named pipes on Windows, Mio may return invalid tokens that correspond to named pipes that have already been deregistered from the Mio registry. The impact of this vulnerability depends on how Mio is used, but for applications that store pointers in the tokens, it may result in a use-after-free vulnerability. Tokio is also vulnerable when using a vulnerable version of Mio and at least Tokio v1.30.0. However, versions of Tokio prior to v1.30.0 will ignore invalid tokens, reducing the risk. This vulnerability has been fixed in Mio v0.8.11, so users are advised to update to the latest version to remediate the issue and prevent potential crashes or use-after-free vulnerabilities in their applications.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-27308 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options