Skip to content

Commit 72cb529

Browse files
Add maxminddb mmap unsoundness advisory
1 parent 0071343 commit 72cb529

File tree

1 file changed

+26
-0
lines changed

1 file changed

+26
-0
lines changed
Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "maxminddb"
5+
date = "2025-11-28"
6+
url = "https://github.com/oschwald/maxminddb-rust/issues/86"
7+
references = ["https://github.com/oschwald/maxminddb-rust/commit/98f0e4fff9678c841ed33f3b8a46322f6163c32a"]
8+
categories = ["memory-corruption"]
9+
keywords = ["mmap"]
10+
11+
[affected.functions]
12+
"maxminddb::Reader::open_mmap" = ["< 0.27.0, >= 0.11.0"]
13+
"maxminddb::Reader::open" = ["< 0.12.0, >= 0.11.0"]
14+
15+
[versions]
16+
patched = [">= 0.27.0"]
17+
unaffected = ["< 0.11.0"]
18+
```
19+
20+
# `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe
21+
22+
maxminddb prior to version 0.27 declared `Reader::open_mmap` as safe
23+
despite wrapping an inherently unsafe memmap2 operation with no
24+
extra step done to guarantee safety. This could have led to undefined
25+
behaviour if the file were to be modified on disk while the memory map
26+
was still active.

0 commit comments

Comments
 (0)