Security readout for executives and security teams
Plain-English summary
CVE-2021-45710 affects Rust applications using vulnerable Tokio versions. Under specific oneshot-channel conditions, a closed channel could trigger a data race and memory corruption. This is a dependency risk, not a named product flaw, so exposure depends on whether your Rust services include the affected crate versions.
Executive priority
Handle during normal vulnerability remediation, with faster action for externally exposed or critical Rust services. The main business risk is unstable or unsafe behavior from memory corruption in foundational async runtime code.
Technical view
The Tokio crate before 1.8.4 and 1.9.x through 1.13.x before 1.13.1 had a data race and memory corruption issue involving closed oneshot channels. The provided CVE data has no CVSS, CWE, CPE, or public exploit details.
Likely exposure
Most likely exposed systems are Rust services, agents, CLIs, or infrastructure components that directly or transitively depend on vulnerable Tokio versions in the stated ranges. Organizations without Rust assets or without Tokio in dependency manifests are unlikely to be affected.
Exploitation context
The source bundle does not identify active exploitation, public exploit code, or inclusion in CISA KEV. Treat this as a potentially serious memory-safety dependency issue, but do not assume real-world exploitation from the provided evidence.
Researcher notes
Version evidence comes from RustSec and the CVE description. CVE metadata lacks CVSS, CWE, and CPE details, so validation should focus on Rust package inventory and resolved Tokio versions rather than product matching.
Mitigation direction
- Upgrade Tokio to 1.8.4, 1.13.1, or a later non-affected release.
- Check RustSec advisory guidance for any additional vendor-specific context.
- Refresh lockfiles so transitive dependencies resolve to fixed Tokio versions.
- Prioritize internet-facing or high-availability Rust services first.
Validation and detection
- Review Cargo.toml, Cargo.lock, and SBOMs for Tokio dependency versions.
- Confirm no direct dependency pins Tokio in the vulnerable ranges.
- Check transitive dependency trees for packages pulling vulnerable Tokio versions.
- Run Rust dependency security auditing in CI or release validation.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-45710 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://rustsec.org/advisories/RUSTSEC-2021-0124.htmlCVE reference · x_refsource_MISC
- https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tokio/RUSTSEC-2021-0124.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.