CVE-2026-65065 in Data::RoaringBitmap::Shared
Summary
by MITRE • 07/21/2026
Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in roaring.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in Data::RoaringBitmap::Shared versions prior to 002 presents a critical security flaw rooted in improper file handling practices within Perl's shared memory implementation. This issue manifests through the creation of world-readable memory mapping files that expose sensitive data to unauthorized local users. The core technical problem stems from the open() system call invocation in roaring.h which uses O_RDWR|O_CREAT flags with a permissions mode of 0666, creating files with default world-read permissions under standard umask settings. This fundamental flaw creates an attack surface where any local user can access the inter-process communication payloads stored within these shared segments.
The vulnerability extends beyond simple permission misconfiguration through the absence of crucial open() flags that would prevent malicious manipulation of the file creation process. Specifically, the omission of O_NOFOLLOW creates a symlink traversal risk where an attacker can plant a symbolic link at the target path, causing the application to open the unintended file instead of the intended shared segment. Additionally, the lack of O_EXCL means that if a malicious user pre-creates a file at the target location, the system will silently use that existing file rather than failing with an error condition. This race condition vulnerability allows attackers to gain control over the file content or redirect the memory mapping to their own data structures.
The operational impact of this vulnerability is severe and directly affects systems where Data::RoaringBitmap::Shared is deployed in shared directories such as /tmp or /dev/shm, which are commonly used for inter-process communication. These locations inherently allow any local user to create files and manipulate the filesystem, making them ideal attack vectors for exploitation. The world-readable nature of the created segments means that sensitive data processed by applications using this library becomes accessible to all local users, potentially exposing confidential information, cryptographic keys, or other critical payloads stored in memory mappings. This weakness effectively undermines the security model of shared memory implementations and creates persistent access points for local privilege escalation attacks.
Security professionals should implement multiple mitigation strategies to address this vulnerability. Immediate remediation involves upgrading to Data::RoaringBitmap::Shared version 0.02 or later, which properly implements secure file creation practices. System administrators should also enforce stricter directory permissions on shared locations and implement monitoring for unauthorized file creation in temporary directories. The fix addresses the underlying CWE-73 relative path traversal vulnerability by ensuring proper file descriptor flags are used during creation operations. From an ATT&CK perspective this vulnerability maps to T1059 command and scripting interpreter execution through potential abuse of local file system manipulation, and T1548 legitimate credentials for privilege escalation when attackers exploit the shared memory access to gain unauthorized data access. Organizations should also consider implementing mandatory access controls or filesystem integrity monitoring solutions to detect and prevent such race condition attacks in environments where legacy versions may still be present.