Threat Intelligence Database

Data::RingBuffer::Shared versions before 0.04 for Perl create a memory-mapped backing file with world-readable permissions and open it without using secure flags O_EXCL or O_NOFOLLOW. This allows local users to read inter-process communication payloads stored in the shared segment and enables local attackers to exploit race conditions or symlink attacks to redirect file access. The vulnerability arises from incorrect permission assignment and insecure file opening practices in a shared directory.

A critical stack-based buffer overflow vulnerability exists in Data::RingBuffer::Shared versions before 0.04 for Perl. The flaw arises from an unvalidated elem_size parameter in the ring_read_seq function, which copies data into a fixed 8-byte stack buffer without proper bounds checking. This allows an attacker with local write access to the backing file to cause stack corruption by specifying an elem_size larger than 8 bytes.