RUSTSEC-2020-0021: rio: rio allows a use-after-free buffer access when a future is leaked

Description

When a rio::Completion is leaked, its drop code will not run. The drop code is responsible for waiting until the kernel completes the I/O operation into, or out of, the buffer borrowed by rio::Completion. Leaking the struct will allow one to access and/or drop the buffer, which can lead to a use-after-free, data races or leaking secrets.

Upstream is not interested in fixing the issue.

More Info

https://github.com/spacejam/rio/issues/11

Patched Versions