https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:15:09 +0000 https://vulnerability.circl.lu/vuln/rustsec-2025-0142 <p><strong>Affected:</strong> crates.io: mnl</p> <p>The function `mnl::cb_run` is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.</p> <p>Passing a crafted byte slice to `mnl::cb_run` can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.</p> <p>This vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.</p> <p>The underlying issue is a bug in `libmnl` where during validation `nlh-&gt;nlmsg_len` is cast to an `int` and becomes negative if `nlmsg_len` is greater than `INT_MAX`. This causes the validation to succeed even if the buffer is too small for the message. This has been fixed in `libmnl` but still affects version 1.0.5.</p> <p>The issue in `mnl` was fixed in commit `cd51bdc` by checking the validity of netlink messages passed to `mnl::cb_run`.</p> <p><strong>Affected:</strong> crates.io: mnl</p> <p>The function `mnl::cb_run` is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.</p> <p>Passing a crafted byte slice to `mnl::cb_run` can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.</p> <p>This vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.</p> <p>The underlying issue is a bug in `libmnl` where during validation `nlh-&gt;nlmsg_len` is cast to an `int` and becomes negative if `nlmsg_len` is greater than `INT_MAX`. This causes the validation to succeed even if the buffer is too small for the message. This has been fixed in `libmnl` but still affects version 1.0.5.</p> <p>The issue in `mnl` was fixed in commit `cd51bdc` by checking the validity of netlink messages passed to `mnl::cb_run`.</p> https://vulnerability.circl.lu/vuln/rustsec-2025-0142