EUVD-2026-46372
GHSA-8xr7-6jgf-m2rq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
AV:L and PR:L because exploitation requires a local standard user account; C:L only as impact is limited to reading IPC payloads; I:N and A:N confirmed by description.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in ndarray.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
World-readable shared memory segments in Data::NDArray::Shared before 0.02 expose IPC payloads to any local user on the system. The module's ndarray.h creates mmap backing files in shared directories such as /tmp or /dev/shm with effective permissions 0644 (world-readable under umask 022) and omits both O_EXCL and O_NOFOLLOW from the open call, enabling passive eavesdropping on shared memory contents and a pre-creation race or symlink-redirect attack by any unprivileged local account. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low exploitation probability; risk is concentrated in multi-tenant or shared-hosting environments where untrusted local users coexist with processes passing sensitive data through this module.
Technical ContextAI
Data::NDArray::Shared is a Perl CPAN module (CPE: cpe:2.3:a:egor:data::ndarray::shared) that enables inter-process sharing of N-dimensional arrays via memory-mapped files. The vulnerable code in ndarray.h calls open(path, O_RDWR|O_CREAT, 0666); the mode 0666 is reduced by the process umask (typically 022) to 0644, leaving the backing file world-readable. CWE-732 (Incorrect Permission Assignment for Critical Resource) is the root-cause class. The absence of O_EXCL means that if a file already exists at the path, the open silently proceeds against it rather than failing, enabling an attacker to pre-plant a file before the legitimate process creates its segment. The absence of O_NOFOLLOW means a symlink planted at the expected path is transparently followed, redirecting the segment to an attacker-controlled location. Because shared segments are by design placed in world-writable directories (/tmp, /dev/shm), local users have the write access needed to plant files or symlinks at arbitrary paths within those directories.
RemediationAI
Upgrade to Data::NDArray::Shared version 0.02 or later via CPAN (cpan install Data::NDArray::Shared or cpanm Data::NDArray::Shared), which is the vendor-released fix confirmed by the published diff and changelog at https://metacpan.org/release/EGOR/Data-NDArray-Shared-0.02/changes. If immediate upgrade is not feasible, operators should redirect the module's backing-file directory to a private path owned exclusively by the running process user (mode 0700) rather than the default /tmp or /dev/shm; this prevents other local users from reading or pre-planting files, though it requires application-level configuration and limits sharing to processes running under the same UID. A secondary compensating control is to avoid passing highly sensitive credentials or cryptographic material through this shared segment, reducing the confidentiality impact of any residual exposure. No trade-off-free workaround exists short of upgrading, as the world-readable permission and missing flags are inherent to the pre-0.02 open call in ndarray.h.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today