[renovate]

This PR contains the following updates:

Package	Type	Update	Change
mnl	dependencies	minor	0.2 → 0.3

---

mnl has segmentation fault and invalid memory read in mnl::cb_run

GHSA-585q-cm62-757j / RUSTSEC-2025-0142

More information

Details

The function mnl::cb_run is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.

Passing a crafted byte slice to mnl::cb_run can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.

This vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.

Severity

• CVSS Score: 2.0 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://github.com/mullvad/mnl-rs/issues/15
• https://github.com/mullvad/mnl-rs/pull/21
• https://github.com/mullvad/mnl-rs/commit/61929d11c13b6cc4f864840a586fd48c6fd20ad9
• https://github.com/mullvad/mnl-rs
• https://rustsec.org/advisories/RUSTSEC-2025-0142.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Segmentation fault and invalid memory read in mnl::cb_run

GHSA-585q-cm62-757j / RUSTSEC-2025-0142

More information

Details

The function mnl::cb_run is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.

Passing a crafted byte slice to mnl::cb_run can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.

This vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.

The underlying issue is a bug in libmnl where during validation nlh->nlmsg_len is cast to an int and becomes negative if nlmsg_len is greater than INT_MAX. This causes the validation to succeed even if the buffer is too small for the message. This has been fixed in libmnl but still affects version 1.0.5.

The issue in mnl was fixed in commit cd51bdc by checking the validity of netlink messages passed to mnl::cb_run.

Severity

Unknown

References

• https://crates.io/crates/mnl
• https://rustsec.org/advisories/RUSTSEC-2025-0142.html
• https://github.com/mullvad/mnl-rs/issues/15

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Release Notes

mullvad/mnl-rs (mnl)

v0.3.1

Compare Source

Fixed

• Fix unsoundness in cb_run and cb_run2 when called with malformed netlink messages.
  This fixes RUSTSEC-2025-0142.

v0.3.0

Compare Source

Changed

• Rename Socket::recv to Socket::recv_raw.
• Add new Socket::recv that returns an iterator of netlink messages (NlMessages).
• Update to Rust 2024 and bump MSRV to 1.85.

---

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.