CVE-2023-22466

Tokio rejectremoteclients configuration may get dropped when creating a Windows named pipe

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

References

https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients

When configuring a Windows named pipe server, setting pipe_mode will reset reject_remote_clients to false. If the application has previously configured reject_remote_clients to true, this effectively undoes the configuration. This also applies if reject_remote_clients is not explicitly set as this is the default configuration and is cleared by calling pipe_mode.

Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publically shared folder (SMB).

CVE-2023-22466 has a CVSS score of 5.4 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.18.4, 1.20.3, 1.23.1); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

The following versions have been patched:

• 1.23.1
• 1.20.3
• 1.18.4

The fix will also be present in all releases starting from version 1.24.0.

Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected.

1. What is CVE-2023-22466? CVE-2023-22466 is a medium-severity security vulnerability in tokio (rust), affecting versions >= 1.7.0, < 1.18.4. It is fixed in 1.18.4, 1.20.3, 1.23.1.
2. How severe is CVE-2023-22466? CVE-2023-22466 has a CVSS score of 5.4 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of tokio are affected by CVE-2023-22466? tokio (rust) versions >= 1.7.0, < 1.18.4 is affected.
4. Is there a fix for CVE-2023-22466? Yes. CVE-2023-22466 is fixed in 1.18.4, 1.20.3, 1.23.1. Upgrade to this version or later.
5. Is CVE-2023-22466 exploitable, and should I be worried? Whether CVE-2023-22466 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2023-22466 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2023-22466?
   • Upgrade tokio to 1.18.4 or later
   • Upgrade tokio to 1.20.3 or later
   • Upgrade tokio to 1.23.1 or later

Other vulnerabilities in tokio