EUVD-2026-46382
GHSA-xqf2-wg33-4hp8
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Local vector confirmed; PR:N as any unprivileged local user qualifies; I:L added because O_NOFOLLOW absence enables symlink-redirect write to arbitrary files.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in dsu.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC payloads to any local user on the host. The module's dsu.h creates the shared segment with open(path, O_RDWR|O_CREAT, 0666), resulting in a 0644-mode file under the default umask - readable by all local accounts - typically placed in /tmp or /dev/shm. The absent O_EXCL flag silently adopts a pre-planted file, and the absent O_NOFOLLOW flag follows symlinks at the target path, enabling a local attacker to either read IPC data or redirect file operations. No active exploitation confirmed; EPSS is 0.16% (6th percentile), consistent with the niche deployment footprint.
Technical ContextAI
Data::DisjointSet::Shared is a CPAN Perl module (CPE: cpe:2.3:a:egor:data::disjointset::shared) that implements a shared-memory disjoint-set (union-find) data structure using mmap-backed files for IPC between processes. The vulnerability is rooted in CWE-732 (Incorrect Permission Assignment for Critical Resource): the backing file is created with octal mode 0666, which resolves to 0644 under the common umask of 022, leaving it world-readable. Two additional POSIX flag omissions compound the issue: (1) the absence of O_EXCL means if a file already exists at the target path, open() succeeds silently rather than failing with EEXIST, allowing a race-condition pre-planting attack; (2) the absence of O_NOFOLLOW means a symlink planted at the path is dereferenced, potentially redirecting the open to an attacker-controlled filesystem location. Shared IPC files are conventionally placed in globally writable directories such as /tmp or /dev/shm, maximising exposure on multi-user systems. The fix in version 0.02 corrects the permission mask and adds the missing flags, as visible in the published diff on MetaCPAN.
RemediationAI
Upgrade Data::DisjointSet::Shared to version 0.02 or later via CPAN (cpan install Data::DisjointSet::Shared or cpanm Data::DisjointSet::Shared). The patch corrects the file permission mode and adds O_EXCL and O_NOFOLLOW to the open(2) call in dsu.h, as confirmed by the published diff at https://metacpan.org/release/EGOR/Data-DisjointSet-Shared-0.02/diff/EGOR/Data-DisjointSet-Shared-0.01#dsu.h. If immediate upgrade is not possible, a compensating control is to restrict the shared directory to a dedicated group or use a private per-application tmpfs mount (e.g., mount a tmpfs owned by the application's service account and set TMPDIR accordingly), ensuring no other local users have read access to the backing file. Note that this workaround requires application-level configuration and does not address the O_EXCL/O_NOFOLLOW race on the open call itself. No other workarounds are independently documented.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today