EUVD-2026-46381
GHSA-fm8j-jqfj-cvjh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Local attack vector with low-privilege account required; scope change because attacker reads another process's IPC data; no integrity or availability impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in sphash.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a multi-user system to read the contents of shared memory payloads written by other processes using the module. The root cause is a combination of overly permissive file creation mode (0666, yielding 0644 under default umask) and the absence of O_EXCL and O_NOFOLLOW flags when opening the mmap backing file in sphash.h, enabling both passive eavesdropping and pre-creation file/symlink attacks. No active exploitation has been identified (EPSS: 0.16%, 6th percentile; not in CISA KEV), and the fix is available in version 0.02.
Technical ContextAI
Data::SpatialHash::Shared is a Perl IPC module that backs a shared spatial hash structure with a memory-mapped file, typically placed in a world-writable shared directory such as /tmp or /dev/shm. The vulnerable code in sphash.h issues open(path, O_RDWR|O_CREAT, 0666), which has three compounding weaknesses rooted in CWE-732 (Incorrect Permission Assignment for Critical Resource): (1) the 0666 creation mode yields a 0644 file under the standard umask 022, making the segment world-readable to any local user; (2) the absence of O_EXCL means a pre-planted regular file at the target path is silently adopted rather than triggering an error, allowing an attacker to substitute their own file; (3) the absence of O_NOFOLLOW means a symlink planted at the path is followed, enabling redirection of the segment open to an attacker-controlled location. The affected CPE is cpe:2.3:a:egor:data::spatialhash::shared:*:*:*:*:*:*:*:*, covering all releases before 0.02.
RemediationAI
Upgrade Data::SpatialHash::Shared to version 0.02 or later via CPAN (cpanm Data::SpatialHash::Shared or cpan Data::SpatialHash::Shared); this is the vendor-released patch confirmed by CPANSec and documented at https://metacpan.org/release/EGOR/Data-SpatialHash-Shared-0.02/changes. The fix corrects the file creation flags in sphash.h to use O_EXCL and O_NOFOLLOW and should restrict the creation mode to 0600 or 0640. If immediate upgrade is not possible, a specific compensating control is to set a restrictive umask (e.g., umask 0177 or 0077) in the application process before the shared segment is initialized, which limits file-system exposure; however, this does not address the O_EXCL or O_NOFOLLOW absence and a local attacker who pre-plants a file or symlink before the process starts can still exploit those gaps. Additionally, configuring the segment path to a directory accessible only to the application user (rather than /tmp or /dev/shm) eliminates the shared-directory race surface entirely, though this may require application-level configuration changes.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today