EUVD-2026-46370
GHSA-j7qm-25rr-qxjr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Local standard-user access required; scope change reflects cross-process IPC leakage; no integrity or availability impact applies.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in deque.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication queue contents to any local user due to a world-readable mmap backing file and unsafe open() flags. The shared segment is created in /tmp or /dev/shm with mode 0644 (after umask 022), and the absence of O_NOFOLLOW and O_EXCL permits symlink-following and pre-creation race attacks against the backing file path. Any local account on a multi-user host can passively read sensitive IPC payloads, or actively redirect the segment open via a pre-planted symlink. No active exploitation has been identified - EPSS is 0.16% (6th percentile) and the vulnerability is not in CISA KEV.
Technical ContextAI
The vulnerable code is in deque.h, the C-level backing implementation of the Data::Deque::Shared Perl module (CPE: cpe:2.3:a:egor:data::deque::shared). The mmap segment file is created with open(path, O_RDWR|O_CREAT, 0666), which under the standard umask of 022 results in a world-readable 0644 file. CWE-732 (Incorrect Permission Assignment for Critical Resource) is the root cause: the backing file holds IPC queue payloads that are readable by all local users. The missing O_NOFOLLOW flag means the kernel follows any symlink at the target path, and the missing O_EXCL flag means a pre-existing file silently wins instead of triggering an error, enabling TOCTOU symlink-substitution attacks. Because 'Shared' segments are designed to live in directories like /tmp or /dev/shm that are world-writable and shared across all local users, both the passive read path and the race-condition path are accessible to any unprivileged local account.
RemediationAI
Upgrade to Data::Deque::Shared version 0.06 or later, which is available on CPAN and constitutes the vendor-released patch for this vulnerability. The specific fix can be reviewed at https://metacpan.org/release/EGOR/Data-Deque-Shared-0.06/diff/EGOR/Data-Deque-Shared-0.05#deque.h and the changelog is at https://metacpan.org/release/EGOR/Data-Deque-Shared-0.06/changes. If immediate patching is not feasible, two compensating controls reduce exposure with trade-offs: first, configuring a restrictive umask (e.g., umask 0177) for processes using the module reduces the backing file to mode 0400 (owner-read only), eliminating the passive read path, but does not address the O_NOFOLLOW/O_EXCL race conditions and will affect all files created by that process; second, placing the shared segment in a dedicated directory with mode 0700 owned by the application user - rather than /tmp or /dev/shm - eliminates access by other local users entirely, but requires configuration changes to the application's segment path and may require application restart. Neither workaround substitutes for patching.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today