EUVD-2026-46379
GHSA-v6hr-647x-cg64
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Local low-privileged user reads world-accessible shared memory file; scope change reflects cross-process data exposure; no integrity or availability impact applies.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in ring.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
World-readable mmap backing file creation and missing symlink/exclusivity guards in Data::RingBuffer::Shared before version 0.04 expose inter-process IPC payloads to any local user on the host. The module creates its shared segment in ring.h with mode 0666 (effective 0644 under default umask 022), making contents in /tmp or /dev/shm readable by all local users; omission of O_EXCL and O_NOFOLLOW further enables pre-creation race and symlink-redirect attacks. No public exploit has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low exploitation probability commensurate with the module's niche deployment footprint.
Technical ContextAI
Data::RingBuffer::Shared is a Perl CPAN module (CPE: cpe:2.3:a:egor:data::ringbuffer::shared) implementing a shared-memory ring buffer via mmap-backed files, designed for inter-process communication and typically stored in world-accessible directories such as /tmp or /dev/shm. The root cause is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource): the segment creation call in ring.h is open(path, O_RDWR|O_CREAT, 0666), which under the standard umask of 022 yields a file with mode 0644 - world-readable. Two compounding flag omissions exist: the absence of O_EXCL means a pre-existing file at the target path is silently adopted rather than triggering an error (enabling pre-creation attacks), and the absence of O_NOFOLLOW means a symbolic link planted at the target path is transparently followed (enabling path-redirection attacks). Both attack vectors are feasible against the IPC data of any process using the module on a shared host.
RemediationAI
Vendor-released patch: version 0.04. Upgrade Data::RingBuffer::Shared to 0.04 or later via CPAN (cpan Data::RingBuffer::Shared or cpanm Data::RingBuffer::Shared); the full changelog is available at https://metacpan.org/release/EGOR/Data-RingBuffer-Shared-0.04/changes. If immediate upgrade is not feasible, restrict the backing file directory to a private path owned exclusively by the application user (mode 0700) rather than /tmp or /dev/shm, which eliminates both the world-readable disclosure and the symlink/pre-creation attack surface - note this requires application-level configuration and may not be supported by all module versions without patching. Applying a restrictive process umask (e.g., 0177) at the process level reduces the world-readable risk but does not address the missing O_EXCL and O_NOFOLLOW flags; it should be treated as a partial compensating control only. Additional VulDB advisory context is available at https://vuldb.com/vuln/381045.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today