CVE-2026-65064

{"id": "CVE-2026-65064", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65064", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T12:54:05.749415Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.0}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/vividsnow/perl5-data-hashmap-shared", "vendor": "EGOR", "product": "Data::HashMap::Shared", "versions": [{"status": "affected", "version": "0", "lessThan": "0.14", "versionType": "custom"}], "packageName": "Data-HashMap-Shared", "programFiles": ["shm_generic.h"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}]}], "published": "2026-07-21T20:17:05.430", "references": [{"url": "https://metacpan.org/release/EGOR/Data-HashMap-Shared-0.14/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/EGOR/Data-HashMap-Shared-0.14/diff/EGOR/Data-HashMap-Shared-0.13#shm_generic.h", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Data::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.\n\nThe segment is created in shm_generic.h with open(path, O_RDWR | O_CREAT | O_CLOEXEC, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.\n\nA \"Shared\" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open."}, {"lang": "es", "value": "Las versiones de Data::HashMap::Shared anteriores a la 0.14 para Perl crean un archivo de respaldo mmap de lectura mundial y lo abren sin O_EXCL ni O_NOFOLLOW.\n\nEl segmento se crea en shm_generic.h con open(path, O_RDWR | O_CREAT | O_CLOEXEC, 0666). El modo es 0666, por lo que bajo la umask predeterminada 022 el archivo se crea con el modo 0644 (de lectura mundial). O_NOFOLLOW est\u00e1 ausente, por lo que se sigue un enlace simb\u00f3lico plantado en la ruta, y O_EXCL est\u00e1 ausente, por lo que la apertura utiliza silenciosamente un archivo pre-plantado en lugar de fallar.\n\nUn segmento \u2019Shared\u2019 reside naturalmente en un directorio compartido como /tmp o /dev/shm, donde cualquier usuario local puede leer las cargas \u00fatiles IPC almacenadas en el segmento de lectura mundial, y un archivo pre-plantado o enlace simb\u00f3lico en la ruta permite a un atacante local ganar una condici\u00f3n de carrera de pre-creaci\u00f3n o redirigir la apertura."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}