Executive brief
A vulnerability in the Data::HashMap::Shared Perl module, which is used for sharing data between different processes, could allow a local attacker to access sensitive information. Because the module creates temporary files with insecure permissions in shared directories like /tmp, any user on the same system can read the data stored in these files. Additionally, an attacker could trick the software into writing data to an unintended location or intercepting the data before it is created.
Technical details
The vulnerability exists in shm_generic.h where the open() system call is used with mode 0666 and lacks O_EXCL and O_NOFOLLOW flags. Under a default umask of 022, this results in the creation of world-readable (0644) mmap backing files in shared directories such as /tmp or /dev/shm. A local attacker can exploit this to read IPC payloads or perform a symlink attack to redirect file operations to an arbitrary path. The lack of O_EXCL also allows an attacker to win a race condition by pre-planting a file at the expected path. The issue is addressed in version 0.14.
Affected products
- EGOR (vividsnow) Data::HashMap::Shared < 0.14
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory