EUVD-2026-46374
GHSA-grf7-5crv-x7vq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Local access and a low-privilege account suffice; scope changes as attacker reads another process's IPC data; only confidentiality is impacted.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in reqrep.h with open(path, O_RDWR | O_CREAT, 0666), for both the request-reply and the integer-variant segments. The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
World-readable mmap backing files in Data::ReqRep::Shared (Perl) versions before 0.05 expose IPC request-reply payloads to any local user on multiuser Unix/Linux systems. The module's reqrep.h creates shared memory segments in directories like /tmp or /dev/shm with open() using O_RDWR|O_CREAT and mode 0666, yielding 0644 under a default umask of 022 - readable by all local users. Two additional unsafe-open defects compound the issue: the absence of O_NOFOLLOW enables symlink redirection, and the absence of O_EXCL allows silent reuse of a pre-planted file. No public exploit code has been identified and EPSS is 0.16% (6th percentile), indicating no current broad exploitation interest.
Technical ContextAI
Data::ReqRep::Shared is a Perl CPAN module (CPE: cpe:2.3:a:egor:data::reqrep::shared) that implements shared memory-based IPC using mmap-backed files, covering both request-reply and integer-variant segment types. The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource), specifically in reqrep.h where open(path, O_RDWR | O_CREAT, 0666) is used for segment creation. Under POSIX, file permissions are masked by the process umask; the standard umask of 022 reduces 0666 to 0644, which grants world-read access. The missing O_NOFOLLOW flag means the kernel will silently follow a symbolic link at the target path, redirecting the open to an attacker-chosen file. The missing O_EXCL flag means that if a file already exists at the path, it is reused without error rather than triggering a failure, enabling pre-creation attacks. Because the design places segments in globally writable shared directories (/tmp, /dev/shm), all local users have the directory access needed to exploit both the passive read and the active pre-plant paths.
RemediationAI
Upgrade Data::ReqRep::Shared to version 0.05 or later using CPAN ('cpan install Data::ReqRep::Shared' or 'cpanm Data::ReqRep::Shared'); this is the vendor-released patch confirmed via the CPAN diff and changelog. If immediate upgrade is not possible, the most effective compensating control is to configure the application to create its IPC backing files in a directory that is not world-accessible - for example, a dedicated subdirectory under /run or /var, owned by the application's service account with permissions 0700. This eliminates both the passive read path and the pre-plant race without requiring code changes. Alternatively, setting a restrictive umask (0077) for the application process prevents world-readable file creation, though this affects all file creation within the process and may have unintended side effects on other output files. Restricting /tmp to per-user namespaces via PrivateTmp=true in systemd service units also eliminates the shared-directory attack surface entirely. Mounting /tmp with noexec or nosuid does not mitigate this vulnerability.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today