EUVD-2026-46380
GHSA-w6r4-xfw9-67g6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Local vector and low-privilege account required; Scope:Changed because read crosses process-user boundary; no integrity or availability impact applies.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in intern.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to any local user on the same host. The module's intern.h opens its mmap backing file with mode 0666 - effective 0644 under the standard umask - making the segment world-readable, while missing O_EXCL and O_NOFOLLOW flags independently enable a pre-creation file-race and a symlink-redirect attack. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), consistent with the niche deployment footprint of this CPAN IPC library.
Technical ContextAI
Data::Intern::Shared is a Perl CPAN module (author EGOR) that implements string interning across processes via a memory-mapped shared file, typically placed in a shared directory such as /tmp or /dev/shm. The vulnerability is rooted in CWE-732 (Incorrect Permission Assignment for Critical Resource): intern.h calls open(path, O_RDWR|O_CREAT, 0666). Under the standard umask of 022, the resulting file permission is 0644, making the IPC backing file world-readable by all local users. Two additional missing flags independently compound the risk: the absence of O_EXCL causes the open() call to silently reuse a pre-existing file instead of failing atomically, enabling a pre-creation race; the absence of O_NOFOLLOW causes the kernel to follow a symlink placed at the expected path, enabling redirect attacks. The affected CPE is cpe:2.3:a:egor:data::intern::shared with all versions before 0.02.
RemediationAI
Upgrade Data::Intern::Shared to version 0.02 or later via CPAN (cpanm Data::Intern::Shared or cpan install Data::Intern::Shared). The fix is vendor-confirmed and the patched release is available on MetaCPAN at https://metacpan.org/release/EGOR/Data-Intern-Shared-0.02/changes. If an immediate upgrade is blocked, the most effective compensating control is to redirect the backing file to a process-private directory with mode 0700 rather than /tmp or /dev/shm, eliminating world-readability; this requires a code or configuration change. Running affected processes in isolated user namespaces or containers with a private /tmp mount also eliminates co-tenant read access without code changes, though it introduces operational overhead. Setting a restrictive umask (e.g., 077) at process startup will NOT fix the root cause because intern.h hardcodes 0666 as the mode argument to open(); the mode is applied before the umask mask calculation, and the hardcoded value overrides any umask tighter than 022 only partially. Completely disabling the module is an option if shared string-interning IPC is not required by the application.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today