Executive brief
Data::Graph::Shared is a Perl library used for managing shared data structures. A security flaw in versions before 0.04 allows local users on the same system to read sensitive data stored in these shared structures. Additionally, a local attacker could trick the library into writing data to the wrong location or hijacking the data stream, potentially leading to data theft or corruption.
Technical details
The vulnerability exists in graph.h where the open() system call is used with O_RDWR|O_CREAT and a mode of 0666. Due to default umask settings (typically 022), this results in world-readable files (0644) in shared directories like /tmp or /dev/shm, allowing local information disclosure of IPC payloads. Furthermore, the absence of O_NOFOLLOW and O_EXCL flags allows a local attacker to perform a symlink attack or win a race condition to pre-plant a file, potentially redirecting file operations or gaining unauthorized access to the shared memory segment. The issue is fixed in version 0.04 by using mode 0600 and improved file handling.
Affected products
- EGOR Data::Graph::Shared < 0.04
Timeline
- 2026-07-03: patched: Version 0.04 released with security hardening.
- 2026-07-21: disclosed: CVE-2026-64615 published.