GHSA-585q-cm62-757j Segmentation fault and invalid memory read in `mnl::cb_run`
An attacker can cause a segmentation fault or read unmapped memory by sending a malformed Netlink message to applications using the mnl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-585q-cm62-757j?
GHSA-585q-cm62-757j is a vulnerability in mnl, published on 18 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The function mnl::cb_run is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.
Passing a crafted byte slice to mnl::cb_run can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.
This vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.
The underlying issue is a bug in libmnl where during validation nlh->nlmsg_len is cast to an int and becomes negative if nlmsg_len is greater than INT_MAX. This causes the validation to succeed even if the buffer is too small for the message. This has been fixed in libmnl but still affects version 1.0.5.
The issue in mnl was fixed in commit cd51bdc by checking the validity of netlink messages passed to mnl::cb_run.
Which versions are affected by GHSA-585q-cm62-757j?
3 open source packages ship an affected version, including mnl.
| Package | Affected | Fixed in |
|---|---|---|
mnl crates.io | All versions | 0.3.1 |
mnl crates.io | All versions | 0.3.1 |
mnl crates.io | From 0.0.0-0 | 0.3.1 |
How do I fix GHSA-585q-cm62-757j?
Upgrade mnl to 0.3.1 or later.
Is GHSA-585q-cm62-757j being exploited?
There is no known exploitation of GHSA-585q-cm62-757j in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0142.