Executive brief
Data::RadixTree::Shared, a Perl library used for managing shared memory data structures, contains a security flaw in how it handles temporary files. Because these files are created with insecure permissions and without proper safety checks, a local attacker on the same system could read sensitive data stored in the shared memory or redirect the application to overwrite other files. This could lead to unauthorized data access or system instability.
Technical details
The vulnerability exists in radix.h where the mmap backing file is created using open(path, O_RDWR|O_CREAT, 0666). Due to the lack of O_EXCL and O_NOFOLLOW flags, the library is susceptible to symlink attacks and race conditions if the backing file is located in a shared directory like /tmp or /dev/shm. Furthermore, the 0666 mode results in world-readable permissions (typically 0644 under default umasks), allowing any local user to read IPC payloads. An attacker can pre-plant a file or symlink to intercept data or redirect file operations. The issue is addressed in version 0.02.
Affected products
- EGOR Data::RadixTree::Shared before 0.02
Timeline
- 2026-07-21: advisory
- 2026-07-21: disclosed