EUVD-2026-46377
GHSA-jq3v-5cfp-pm6x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Local access and a valid user account required; world-readable file exposure is AC:L with no race needed; scope change reflects cross-process IPC boundary; confidentiality limited to IPC payload contents.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in shm_generic.h with open(path, O_RDWR | O_CREAT | O_CLOEXEC, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
World-readable mmap backing file creation in Data::HashMap::Shared (Perl CPAN module) versions before 0.14 exposes inter-process communication payloads to any local user co-resident on the same system. The module's shm_generic.h opens its shared memory segment with mode 0666 (resulting in 0644 under default umask 022) in world-accessible directories such as /tmp or /dev/shm, while omitting both the O_EXCL and O_NOFOLLOW flags - enabling a local attacker to either read IPC payloads directly from the world-readable file or redirect the open via a pre-planted symlink. No public exploit has been identified (EPSS 0.16%, 6th percentile) and there is no CISA KEV listing, but the primary information-disclosure vector requires no race condition and is trivially exploitable by any unprivileged local user on a multi-tenant system.
Technical ContextAI
Data::HashMap::Shared is a Perl CPAN module (CPE: cpe:2.3:a:egor:data::hashmap::shared) that implements shared hash maps across processes using memory-mapped files backed by POSIX shared memory. The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource): in shm_generic.h, the backing file is created via open(path, O_RDWR | O_CREAT | O_CLOEXEC, 0666). Three distinct weaknesses compound here - (1) the 0666 mode results in world-readable 0644 files under the standard umask 022, exposing IPC payloads to all local users; (2) absence of O_NOFOLLOW means the kernel will follow any symlink planted at the target path in /tmp or /dev/shm before the legitimate open occurs; (3) absence of O_EXCL means a pre-existing file at that path is silently adopted rather than triggering an error. The fix in version 0.14 addresses all three by correcting the file mode and adding the missing open flags, as documented in the MetaCPAN diff and changelog.
RemediationAI
Upgrade to Data::HashMap::Shared version 0.14 or later via CPAN (cpan install Data::HashMap::Shared or cpanm Data::HashMap::Shared), which corrects the file mode and adds the missing O_EXCL and O_NOFOLLOW flags in shm_generic.h. The patch is confirmed available per the MetaCPAN diff at https://metacpan.org/release/EGOR/Data-HashMap-Shared-0.14/diff/EGOR/Data-HashMap-Shared-0.13#shm_generic.h and changelog at https://metacpan.org/release/EGOR/Data-HashMap-Shared-0.14/changes. If immediate upgrade is not possible, a compensating control is to restrict the shared memory directory: configure the application to use a dedicated directory with mode 0700 or 0750 (owned by the service account) rather than /tmp or /dev/shm, preventing other local users from reading the backing file - note this requires application-level configuration support and does not fix the underlying open-flag deficiency. On Linux, mounting /dev/shm with noexec,nosuid and applying filesystem ACLs to restrict directory traversal to the owning UID provides additional isolation at the cost of operational complexity.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today