[GHSA-mj73-j457-8x9q] maxminddb's Reader::open_mmap unsoundly marks unsafe memmap operation as safe

[oschwald]

Updates

• CVSS v4

Comments
The "attack" here is a local user with write access to the MMDB file being able to cause a sigbus by truncating the affected file. This is true for any application that uses MMAP. The only notable thing is expectations around safety in Rust libraries, which are higher than a C library or Python package.

[Copilot]

Pull request overview

This pull request updates the CVSS v4 severity score for a security advisory related to the maxminddb Rust library. The update reflects a more accurate assessment of the vulnerability's attack vector and required privileges, significantly reducing the severity rating from a network-accessible vulnerability to a local privilege-dependent one.

Key changes:

• Updated CVSS v4 score to reflect that the vulnerability requires local access with high privileges (write access to MMDB file)
• Changed Attack Vector from Network to Local, Privileges Required from None to High, and Vulnerability Integrity from Low to None
• Updated the modification timestamp

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shelbyc]

Hi @oschwald, I read oschwald/maxminddb-rust#86 and am OK with changing the attack vector to local and privileges required to high. I'll keep the integrity impact at low and retain the exploit maturity of unreported. This will lower the CVSS from 2.7/low to 1/low.

[advisory-database]

Hi @oschwald! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[oschwald]

Thank you!