Executive brief
Data::ReqRep::Shared is a Perl library used for sharing data between different processes on a computer. A security flaw allows local users to read sensitive information stored in these shared memory segments because the files are created with overly broad permissions. Additionally, an attacker could trick the software into writing data to the wrong location, potentially leading to data corruption or unauthorized access.
Technical details
Data::ReqRep::Shared before version 0.05 suffers from insecure file handling in reqrep.h. The library creates mmap backing files using open() with the 0666 mode, which results in world-readable files (0644) under standard umask settings, allowing local users to read IPC payloads. Furthermore, the absence of O_NOFOLLOW and O_EXCL flags during the open() call makes the application vulnerable to symlink attacks and race conditions. A local attacker can pre-plant a file or symlink in shared directories like /tmp or /dev/shm to redirect file operations or capture data. The issue is resolved in version 0.05.
Affected products
- EGOR Data::ReqRep::Shared before 0.05
Timeline
- 2026-07-21: advisory: CVE-2026-65061 published by NVD
- 2026-07-21: patched: Version 0.05 released to address the vulnerability