{"id":"GHSA-585q-cm62-757j","aliases":["RUSTSEC-2025-0142"],"status":"published","title":"mnl has segmentation fault and invalid memory read in `mnl::cb_run`","description":"The function `mnl::cb_run` is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.\n\nPassing a crafted byte slice to `mnl::cb_run` can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.\n\nThis vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.","severity":{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2025-10-18T12:00:00Z","modified":"2026-02-10T16:30:09Z","fixes":[{"ecosystem":"crates.io","package":"mnl","fixed_in":["0.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"mnl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.0"},{"fixed":"0.3.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"mnl","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"mnl","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.3.1"}]}]}],"references":[{"url":"https://github.com/mullvad/mnl-rs/issues/15","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0142.html","tags":["web","advisory"]},{"url":"https://github.com/mullvad/mnl-rs/pull/21","tags":["web"]},{"url":"https://github.com/mullvad/mnl-rs/commit/61929d11c13b6cc4f864840a586fd48c6fd20ad9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-585q-cm62-757j"},{"url":"https://github.com/mullvad/mnl-rs","tags":["package"]},{"url":"https://crates.io/crates/mnl","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-585q-cm62-757j","title":"mnl has segmentation fault and invalid memory read in `mnl::cb_run`","description":"The function `mnl::cb_run` is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.\n\nPassing a crafted byte slice to `mnl::cb_run` can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.\n\nThis vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.","status":"published","published":"2026-01-09T19:53:23Z","modified":"2026-02-10T16:05:52Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:39:24.742346Z"}],"osv":[{"id":"GHSA-585q-cm62-757j","title":"mnl has segmentation fault and invalid memory read in `mnl::cb_run`","description":"The function `mnl::cb_run` is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.\n\nPassing a crafted byte slice to `mnl::cb_run` can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.\n\nThis vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.","status":"published","published":"2026-01-09T19:53:23Z","modified":"2026-02-10T16:30:09.738803Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"RUSTSEC-2025-0142","title":"Segmentation fault and invalid memory read in `mnl::cb_run`","description":"The function `mnl::cb_run` is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.\n\nPassing a crafted byte slice to `mnl::cb_run` can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.\n\nThis vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.\n\nThe underlying issue is a bug in `libmnl` where during validation `nlh-\u003enlmsg_len` is cast to an `int` and becomes negative if `nlmsg_len` is greater than `INT_MAX`. This causes the validation to succeed even if the buffer is too small for the message. This has been fixed in `libmnl` but still affects version 1.0.5.\n\nThe issue in `mnl` was fixed in commit `cd51bdc` by checking the validity of netlink messages passed to `mnl::cb_run`.","status":"published","published":"2025-10-18T12:00:00Z","modified":"2026-02-10T13:31:44.174348Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}