EUVD-2026-46369
GHSA-pmmg-wc48-vjhq
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Local access is the only path to the world-readable segment file; no privileges are required as any local user can read the 0644-mode mmap backing file by design.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW.
The segment is created in buf_generic.h with open(path, O_RDWR|O_CREAT|O_EXCL, 0666). O_EXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable), and O_NOFOLLOW is absent, so a symlink planted at the path is followed when the segment is attached.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted symlink at the path redirects the open to another file.
AnalysisAI
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.05) expose inter-process communication payloads to any local user on the affected host. The module's buf_generic.h creates shared memory segments with mode 0666, resulting in 0644 files under the default umask of 022, and omits O_NOFOLLOW during segment attachment, enabling symlink-based file-redirect attacks against /tmp or /dev/shm paths. No exploit code is publicly available and no active exploitation has been confirmed; EPSS at 0.16% (6th percentile) reflects the niche deployment footprint, though any local user on a system running an affected Perl application can trivially read IPC payloads without elevated privileges.
Technical ContextAI
Data::Buffer::Shared is a Perl CPAN module providing shared memory IPC through mmap-backed files, authored under the EGOR CPAN namespace (CPE: cpe:2.3:a:egor:data::buffer::shared:*:*:*:*:*:*:*:*). The root cause, classified as CWE-732 (Incorrect Permission Assignment for Critical Resource), manifests in two related defects within buf_generic.h. First, segment creation uses open(path, O_RDWR|O_CREAT|O_EXCL, 0666): while O_EXCL prevents an attacker from pre-seeding a file at creation time, the 0666 mode produces a 0644 file under the common umask of 022, granting world-read access to any local user. Second, when a process subsequently attaches to an existing segment, the open call lacks O_NOFOLLOW, meaning a symlink placed at the segment path before attachment is silently followed, redirecting the open to an arbitrary file the attacker controls. Because shared segments naturally reside in world-writable directories like /tmp or /dev/shm, both attack surfaces are accessible to unprivileged local users by design of the IPC mechanism. The fix in version 0.05 corrects both the permission mode and adds O_NOFOLLOW, as confirmed by the MetaCPAN diff.
RemediationAI
Upgrade Data::Buffer::Shared to version 0.05 or later using CPAN or cpanm (cpanm Data::Buffer::Shared). The changelog confirming the fix is available at https://metacpan.org/release/EGOR/Data-Buffer-Shared-0.05/changes and the precise code change - correcting file mode and adding O_NOFOLLOW - is visible in the diff at https://metacpan.org/release/EGOR/Data-Buffer-Shared-0.05/diff/EGOR/Data-Buffer-Shared-0.04#buf_generic.h. If immediate patching is blocked by application constraints, restrict the host to trusted local users only, since the attack surface is entirely local. An alternative interim control is to configure the system umask to 0077 for the application user account, preventing the 0644 world-readable mode - but this is a system-wide setting with potential side effects on other processes. Migrating IPC to Unix domain sockets with restrictive permissions (mode 0600) is a more robust compensating control that eliminates both the disclosure and symlink attack surfaces, though it requires application code changes.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today