memmap2 от 0.5.9 до 0.9.10 Сопровождает арифметику бесшумных указателей в шести функциях

Over three years of memmap2 releases (0.5.9 through 0.9.10) shipped six functions that can construct invalid pointers - pointers that see the kernel's madvise and msync syscalls as valid arguments, but are undefined behavior under Rust's safety rules.

The Flaw: Unvalidated Offsets Meet Pointer Arithmetic

Mmap::advise_range, Mmap::unchecked_advise_range, MmapMut::advise_range, MmapMut::flush_async_range, MmapMut::flush_range, and MmapMut::unchecked_advise_range all accept an offset and length without validating the resulting pointer stays within bounds. They call pointer::offset() or pointer::add() to compute a pointer into the mapped region. No dereference happens - but constructing an out-of-bounds pointer via those methods is immediate undefined behavior per Rust's specification.

Advisory RUSTSEC-0000-0000 notes the invalid pointer is then passed to the madvise and msync syscalls (or their Windows equivalents). The UB is real and reachable from safe code if callers supply unsanitized offsets and lengths.

Affected Functions and Version Range

Each function has its own affected version range. advise_range and flush_range variants are vulnerable from 0.5.9 up to but not including 0.9.11. The unchecked_ variants joined in 0.8.0. That's a wide window - any application using memmap2 for memory-mapped I/O with dynamic offsets should verify they are on 0.9.11 or later.

Patching Forward

Fix landed in commit cee7cf0 and was released in version 0.9.11. Users should upgrade immediately. The RustSec advisory database now carries this entry alongside other unsoundness advisories.

The bug is a clean reminder that undefined behavior isn't just about nullptr dereference or use-after-free - passing an invalid pointer to a syscall, even without reading through it, still constitutes UB if that pointer was constructed via safe pointer arithmetic without a safety contract.

Expect more such advisories as the Rust ecosystem continues to surface hidden unsafe code patterns under the unsoundness flag.

Source: Add unsound pointer arithmetic advisory for memmap2. (#2990)
Domain: github.com