Executive brief
Data::SortedSet::Shared is a Perl library used for managing shared data structures. A security flaw in versions before 0.03 allows local users on the same system to read sensitive data stored in these shared sets. Additionally, a malicious user could trick the library into writing data to unauthorized locations or hijack the data stream, potentially leading to data corruption or unauthorized access to information.
Technical details
The vulnerability exists in the 'sortedset.h' component of the Data::SortedSet::Shared Perl module. The library uses the open() system call with O_RDWR|O_CREAT and a mode of 0666 to create mmap backing files, which results in world-readable files (0644) under standard umask settings. Furthermore, the absence of the O_NOFOLLOW flag allows for symlink attacks, and the lack of O_EXCL allows an attacker to win a race condition by pre-planting a file at the expected path (typically in /tmp or /dev/shm). A local attacker can exploit this to read IPC payloads or redirect file operations to arbitrary locations. The issue is resolved in version 0.03.
Affected products
- EGOR (CPAN) Data::SortedSet::Shared < 0.03
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory