GHSA-655h-hg88-5qmf
Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety
GHSA-655h-hg88-5qmf is a low vulnerability (CVSS 1.7) in xcb, published August 5, 2025. No source lists public exploit code. Fixed in xcb 1.6.0.
- Severity
- 1.7 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.6.0xcb +1 more
Description
The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd (such as a UnixStream) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.
Starting in version 1.6.0, xcb provides Connection::connect_with_fd and Connection::connect_with_fd_and_extensions as safe alternatives and deprecates the problematic functions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Affected packages
What each source reports
GitHub Advisories Score used
Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety
The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd (such as a UnixStream) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.
Starting in version 1.6.0, xcb provides Connection::connect_with_fd and Connection::connect_with_fd_and_extensions as safe alternatives and deprecates the problematic functions.
- Record
GHSA-655h-hg88-5qmf- CVSS 4.0
- 1.7 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-666, CWE-672
- Updated
- 2026-11-02
OSV
Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety
The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd (such as a UnixStream) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.
Starting in version 1.6.0, xcb provides Connection::connect_with_fd and Connection::connect_with_fd_and_extensions as safe alternatives and deprecates the problematic functions.
- Record
GHSA-655h-hg88-5qmf- CVSS 4.0
- 1.7 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-666, CWE-672
- Updated
- 2026-11-02
OSVRUSTSEC-2025-0051No score
`xcb::Connection::connect_to_fd*` functions violate I/O safety
The API of xcb::Connection has constructors which allow an arbitrary RawFd
to be used as a socket connection. On either failure of these constructors or
on the drop of Connection, it closes the associated file descriptor. Thus, a
program which uses an OwnedFd (such as a UnixStream) as the file descriptor
can close the file descriptor and continue to attempt using it or close an
already-closed file descriptor, violating I/O safety.
Starting in version 1.6.0, xcb provides Connection::connect_with_fd and
Connection::connect_with_fd_and_extensions as safe alternatives and
deprecates the problematic functions.
- Record
RUSTSEC-2025-0051- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/rust-x-bindings/rust-xcb/issues/167
rustsec.org/advisories/RUSTSEC-2025-0051.html
crates.io/crates/xcb