-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| maxminddb | rust | >= 0.11.0, < 0.27.0 | 0.27.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the maxminddb Rust crate, specifically in the Reader::open_mmap function. This function provides a way to open a MaxMind DB file using memory mapping. The underlying memmap2::MmapOptions::map operation is unsafe because modifying the file on disk while it's memory-mapped can lead to undefined behavior (like a crash or memory corruption). The maxminddb crate initially declared Reader::open_mmap as a safe function, which is incorrect as it doesn't add any safety guarantees on top of the unsafe mmap call. This gives a false sense of security to the users of the library. The patch addresses this by marking Reader::open_mmap as unsafe, which correctly signals to the user that they are responsible for ensuring the file is not modified while the memory map is active. The vulnerable function is Reader::open_mmap as it existed before this change.
Reader::open_mmapsrc/reader.rs
A Semantic Attack on Google Gemini - Read the Latest Research