CVE-2026-64613

{"id": "CVE-2026-64613", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64613", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T12:24:05.650789Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/vividsnow/perl5-data-buffer-shared", "vendor": "EGOR", "product": "Data::Buffer::Shared", "versions": [{"status": "affected", "version": "0", "lessThan": "0.05", "versionType": "custom"}], "packageName": "Data-Buffer-Shared", "programFiles": ["buf_generic.h"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}]}], "published": "2026-07-21T20:17:03.967", "references": [{"url": "https://metacpan.org/release/EGOR/Data-Buffer-Shared-0.05/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/EGOR/Data-Buffer-Shared-0.05/diff/EGOR/Data-Buffer-Shared-0.04#buf_generic.h", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW.\n\nThe segment is created in buf_generic.h with open(path, O_RDWR|O_CREAT|O_EXCL, 0666). O_EXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable), and O_NOFOLLOW is absent, so a symlink planted at the path is followed when the segment is attached.\n\nA \"Shared\" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted symlink at the path redirects the open to another file."}, {"lang": "es", "value": "Las versiones de Data::Buffer::Shared anteriores a la 0.05 para Perl crean un archivo de respaldo mmap legible por cualquier usuario y lo abren sin O_NOFOLLOW.\n\nEl segmento se crea en buf_generic.h con open(path, O_RDWR|O_CREAT|O_EXCL, 0666). O_EXCL bloquea un archivo preexistente al crearlo, pero el modo es 0666, as\u00ed que bajo la umask predeterminada 022 el archivo se crea con el modo 0644 (legible por cualquier usuario), y O_NOFOLLOW est\u00e1 ausente, por lo que un enlace simb\u00f3lico colocado en la ruta es seguido cuando el segmento se adjunta.\n\nUn segmento \u2019Shared\u2019 reside naturalmente en un directorio compartido como /tmp o /dev/shm, donde cualquier usuario local puede leer las cargas \u00fatiles IPC almacenadas en el segmento legible por cualquier usuario, y un enlace simb\u00f3lico preestablecido en la ruta redirige la apertura a otro archivo."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}