Listen to this Post
The vulnerability exists in the `maxminddb` Rust crate’s `Reader::open_mmap` function. This function was incorrectly declared as `safe` while it internally used the `memmap2` crate’s `Mmap` without ensuring necessary safety invariants. The function performs an unsafe block to create a memory map but provides no guarantee that the underlying file on disk remains immutable for the map’s lifetime. If the mapped file is truncated, deleted, or modified by another process after the map is created, subsequent reads through the `Reader` can attempt to access invalid or freed memory. This violates Rust’s safety contract and leads to undefined behavior, including program crashes or reading arbitrary data, as the safe API exposes a hidden race condition.
Platform: Rust crate
Version: Prior to 0.27
Vulnerability: Unsafe Safe Marking
Severity: Low
Date: 2025-12-02
Prediction: Patched 2025-12-02
What Undercode Say:
$ cargo audit
$ grep -n “open_mmap” Cargo.toml
// Vulnerable code signature
impl Reader {
pub fn open_mmap<P: AsRef<Path>>(database: P) -> Result<Reader> {
let file = File::open(database)?;
let mmap = unsafe { Mmap::map(&file)? }; // Unsafe operation
Ok(Reader { mmap, ... })
}
}
How Exploit:
A concurrent process or thread modifies or truncates the memory-mapped MaxMind database file while the `maxminddb::Reader` is still in use. This causes the safe Rust code to dereference pointers to invalid memory regions when performing IP lookups, triggering a segmentation fault or reading corrupted data.
Protection from this CVE:
Update to `maxminddb` version 0.27 or later, where the `Reader::open_mmap` function has been marked as unsafe. Alternatively, use the `Reader::open` method which does not rely on memory mapping.
Impact:
Undefined Behavior, Application Crash, Potential Information Disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
