CVE-2026-64613 in Data::Buffer::Shared
Summary
by MITRE • 07/21/2026
Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW.
The segment is created in buf_generic.h with open(path, O_RDWR|O_CREAT|O_EXCL, 0666). O_EXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable), and O_NOFOLLOW is absent, so a symlink planted at the path is followed when the segment is attached.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted symlink at the path redirects the open to another file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in Data::Buffer::Shared versions before 0.05 stems from improper file creation and access control mechanisms within the Perl module's memory mapping implementation. This flaw creates a critical security issue that affects systems using shared memory segments for inter-process communication. The problem manifests in the buf_generic.h file where the segment is created using open() with flags O_RDWR|O_CREAT|O_EXCL and permission mode 0666. The combination of these parameters introduces multiple attack vectors that can be exploited by malicious local users to gain unauthorized access to shared memory contents.
The technical implementation flaw lies in the insufficient permission handling during file creation. When the module creates a memory mapping segment with mode 0666, it ignores the system's default umask setting of 022, resulting in a final file permission of 0644 which makes the segment world-readable. This violates security principle of least privilege and creates a persistent exposure for sensitive data stored in shared memory areas. The absence of O_NOFOLLOW flag during the open() operation compounds this vulnerability by allowing symbolic link traversal attacks. An attacker can place a malicious symlink at the intended file path, causing the application to open and potentially overwrite arbitrary files on the system.
The operational impact of this vulnerability is significant within local privilege escalation scenarios and information disclosure attacks. Since shared segments are typically created in directories like /tmp or /dev/shm where any local user has read access, attackers can readily inspect the contents of these memory mapping segments. This exposure becomes particularly dangerous when the shared buffer contains sensitive data such as authentication tokens, session information, or application secrets. The combination of world-readable permissions and symlink following creates a perfect storm for privilege escalation attacks where an unprivileged user can manipulate the system's shared memory to access resources they should not normally be able to reach.
The vulnerability maps directly to CWE-732: Incorrect Permission Assignment for Critical Resource and CWE-367: Time-of-Check to Time-of-Use (TOCTOU) Race Condition. From an attack perspective, this flaw aligns with techniques described in the MITRE ATT&CK framework under T1059.007 for Unix Shell and T1548.001 for Abuse of System Permissions. The module's design creates a TOCTOU condition where the file check and creation operations occur separately, allowing an attacker to manipulate the filesystem state between these operations. Organizations should immediately upgrade to version 0.05 or later where proper permission handling and O_NOFOLLOW enforcement have been implemented to prevent world-readable file creation and symlink traversal attacks.
The mitigation strategy requires immediate patching of affected systems using Data::Buffer::Shared versions prior to 0.05, along with monitoring for potential exploitation attempts in shared memory directories. System administrators should also implement proper file permission auditing and consider restricting access to critical shared memory locations through filesystem permissions or containerization. Additionally, implementing intrusion detection systems that monitor for suspicious symlink creation patterns in temporary directories can help identify potential exploitation attempts targeting this specific vulnerability.