Executive brief
Data::HashMap::Shared is a Perl library used for sharing data structures between different processes using shared memory. A vulnerability in how it handles shared data allows a local user with access to the data file to trigger memory errors. This can lead to the application crashing or potentially leaking sensitive information from the computer's memory.
Technical details
An out-of-bounds read vulnerability exists in Data::HashMap::Shared before version 0.14 due to insufficient validation of memory-mapped (mmap) segment data. While the 'shm_validate_header' function validates the header and region layout against file size, it fails to validate individual array contents. Specifically, the 'shm_str_copy' function performs a memcpy using offset and length values read directly from the mmap'd segment without bounds checking. This affects multiple paths including each, keys, values, pop, shift, take, swap, drain, and cursor. A local attacker who can modify the backing file can poison these values to cause the process to read adjacent memory or crash. The 'get' path is notably unaffected as it implements separate bounding.
Affected products
- EGOR (CPAN) Data::HashMap::Shared < 0.14
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched: Fixed in version 0.14