Executive brief
Data::Intern::Shared is a Perl module used for sharing string data between different processes. A security flaw allows a local user who can modify the shared data file to trigger an out-of-bounds memory read. This could allow an attacker to access sensitive information from the memory of other programs using the same shared data.
Technical details
An out-of-bounds read vulnerability exists in the si_idx_find function of Data::Intern::Shared due to insufficient validation of indices within mmap'd segments. While si_validate_header checks basic layout parameters, it fails to validate the slot, reverse, and arena arrays. A local attacker with write access to the backing file can poison these indices to cause triple indirection dereferences outside of the allocated memory bounds. This can be exploited via id_of, intern, or string lookups to disclose adjacent process memory. The issue is addressed in version 0.02.
Affected products
- EGOR Data::Intern::Shared before 0.02
Timeline
- 2026-07-21: advisory
- 2026-07-21: disclosed