Executive brief
A vulnerability in the Data::Intern::Shared Perl module allows local users on a shared system to access sensitive data. The module creates temporary files with insecure permissions, meaning any user on the same machine can read the information stored within them. Additionally, an attacker could trick the software into writing data to the wrong location or hijacking the data stream, potentially leading to information theft or system disruption.
Technical details
The vulnerability exists in intern.h where the open() system call is used with O_RDWR|O_CREAT and a mode of 0666. Due to default umask settings (typically 022), this results in world-readable files (0644) in shared directories like /tmp or /dev/shm. Furthermore, the absence of O_NOFOLLOW and O_EXCL flags allows a local attacker to perform symlink attacks or win a race condition by pre-planting a file at the expected path. This enables unauthorized reading of IPC payloads and redirection of file operations. The issue is addressed in version 0.02.
Affected products
- EGOR (vividsnow) Data::Intern::Shared < 0.02
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched: Fixed in version 0.02