CVE-2026-64613

{
  "id": "CVE-2026-64613",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-07-21T20:17:03.967",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW.\n\nThe segment is created in buf_generic.h with open(path, O_RDWR|O_CREAT|O_EXCL, 0666). O_EXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable), and O_NOFOLLOW is absent, so a symlink planted at the path is followed when the segment is attached.\n\nA \"Shared\" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted symlink at the path redirects the open to another file."
    },
    {
      "lang": "es",
      "value": "Las versiones de Data::Buffer::Shared anteriores a la 0.05 para Perl crean un archivo de respaldo mmap legible por cualquier usuario y lo abren sin O_NOFOLLOW.\n\nEl segmento se crea en buf_generic.h con open(path, O_RDWR|O_CREAT|O_EXCL, 0666). O_EXCL bloquea un archivo preexistente al crearlo, pero el modo es 0666, así que bajo la umask predeterminada 022 el archivo se crea con el modo 0644 (legible por cualquier usuario), y O_NOFOLLOW está ausente, por lo que un enlace simbólico colocado en la ruta es seguido cuando el segmento se adjunta.\n\nUn segmento ’Shared’ reside naturalmente en un directorio compartido como /tmp o /dev/shm, donde cualquier usuario local puede leer las cargas útiles IPC almacenadas en el segmento legible por cualquier usuario, y un enlace simbólico preestablecido en la ruta redirige la apertura a otro archivo."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "EGOR",
          "product": "Data::Buffer::Shared",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Data-Buffer-Shared",
          "programFiles": [
            "buf_generic.h"
          ],
          "repo": "https://github.com/vividsnow/perl5-data-buffer-shared",
          "versions": [
            {
              "version": "0",
              "lessThan": "0.05",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-23T12:24:05.650789Z",
          "id": "CVE-2026-64613",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        },
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/EGOR/Data-Buffer-Shared-0.05/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/EGOR/Data-Buffer-Shared-0.05/diff/EGOR/Data-Buffer-Shared-0.04#buf_generic.h",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}