EUVD-2026-46376
GHSA-c3ff-xfjv-hpqv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Local attack requiring a standard user account (PR:L); S:C because the IPC segment crosses process boundaries; no integrity or availability impact from the primary passive read path.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in radix.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
World-readable mmap backing file creation in Data::RadixTree::Shared before 0.02 exposes inter-process communication payloads to any authenticated local user on the system. The Perl module's radix.h opens the shared segment file with mode 0666 (resolving to 0644 under default umask), while omitting both O_EXCL and O_NOFOLLOW, enabling two distinct local attack paths: passive reading of IPC segment contents from /tmp or /dev/shm, and an active file-planting or symlink-redirection attack exploiting the missing exclusive-creation guard. No public exploit is identified at time of analysis; EPSS at 0.16% (6th percentile) and absence from CISA KEV indicate no current active exploitation.
Technical ContextAI
Data::RadixTree::Shared is a Perl CPAN module (author EGOR, CPE cpe:2.3:a:egor:data::radixtree::shared:*:*:*:*:*:*:*:*) implementing a shared-memory radix tree for IPC via memory-mapped files. The defect resides in radix.h, which calls open(path, O_RDWR|O_CREAT, 0666): the 0666 mode combined with the default system umask of 022 produces a file with permissions 0644, making it world-readable. CWE-732 (Incorrect Permission Assignment for Critical Resource) describes this root cause - the resource (the IPC backing file) is assigned permissions that allow unintended access by other users. Compounding this, the absence of O_EXCL means the kernel silently reuses a pre-existing file at the target path rather than failing the open, and the absence of O_NOFOLLOW means a symlink planted at the path is transparently followed, redirecting the mmap to an attacker-chosen file. Because the module is designed for use with shared directories such as /tmp or /dev/shm, these world-accessible locations are the natural deployment targets where other local users can both read and manipulate paths.
RemediationAI
Upgrade to Data::RadixTree::Shared version 0.02 or later, which is available on CPAN and resolves all three defects (file mode, missing O_EXCL, missing O_NOFOLLOW) as documented in the release diff at https://metacpan.org/release/EGOR/Data-RadixTree-Shared-0.02/diff/EGOR/Data-RadixTree-Shared-0.01#radix.h. Install via cpanm Data::RadixTree::Shared or cpan install Data::RadixTree::Shared. If immediate upgrade is not feasible, configure the application to place its backing file in a private mode-0700 directory owned by the service account rather than /tmp or /dev/shm - this prevents other local users from reading or pre-planting files at the target path, though it does not fix the underlying O_EXCL and O_NOFOLLOW deficiencies in the code. Deploying the service in a container or isolated process namespace with no untrusted local users also eliminates the attack surface without code changes. No workaround fully substitutes for the vendor-released patch at version 0.02.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today