EUVD-2026-46375
GHSA-fm5w-8q32-74c2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Local access and a low-privilege account are required; world-readable file enables cross-process IPC disclosure (scope change), but impact is limited to low confidentiality with no integrity or availability effect.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in sortedset.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
World-readable mmap backing file creation in Data::SortedSet::Shared before 0.03 exposes IPC payloads to any local user and enables symlink or pre-creation race attacks on the same host. The module's sortedset.h opens the shared segment file with mode 0666 (yielding 0644 after umask), no O_EXCL, and no O_NOFOLLOW, meaning a local attacker can passively read any data written to the segment or actively redirect the open() to an attacker-controlled file. No public exploit has been identified at time of analysis; EPSS is 0.16% at the 6th percentile, consistent with the niche footprint of this Perl CPAN module.
Technical ContextAI
CWE-732 (Incorrect Permission Assignment for Critical Resource) describes exactly this class of flaw: a resource shared across security boundaries is created with permissions that allow unintended access. The module implements a sorted set backed by a memory-mapped file for inter-process communication. The file is created in sortedset.h via open(path, O_RDWR|O_CREAT, 0666); after the default umask of 022 is applied, the on-disk file is mode 0644 - world-readable. Two additional flags are absent: O_EXCL would cause open() to fail if the file already exists (preventing silent reuse of a pre-planted file), and O_NOFOLLOW would prevent the kernel from following a symlink at the target path. Because shared segments are typically placed in /tmp or /dev/shm - directories writable by all local users - both the passive disclosure path and the TOCTOU symlink path are viable. Affected CPE: cpe:2.3:a:egor:data::sortedset::shared:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: Data::SortedSet::Shared 0.03, which corrects the open() call in sortedset.h to use restrictive permissions and add O_EXCL and O_NOFOLLOW. Upgrade via CPAN: cpan install Data::SortedSet::Shared or cpanm Data::SortedSet::Shared@0.03. The corrected diff is available at https://metacpan.org/release/EGOR/Data-SortedSet-Shared-0.03/diff/EGOR/Data-SortedSet-Shared-0.02#sortedset.h. If immediate upgrade is not possible, configure the application to place its mmap backing file in a private, application-owned directory (e.g., a tmpfs mount or subdirectory with mode 0700) rather than /tmp or /dev/shm, ensuring no other local user can reach the file path. This mitigates both the passive read path and the symlink race, but requires application-level configuration changes and may not be straightforward for all deployments. Restricting /tmp permissions globally would affect other system services and is not recommended.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today