Threats Tagged 'cwe-732'

An improper access control vulnerability exists in the IRP_MJ_WRITE command interface of Wellbia XIGNCODE3 xhunter2.sys version 2026.6.1.192. This flaw allows a local, unprivileged attacker to escalate privileges to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected security processes.

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.

Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file with insecure permissions and open flags. The file is created with mode 0666 (resulting in 0644 after umask), making it world-readable. The open call lacks O_EXCL and O_NOFOLLOW flags, allowing a local attacker to exploit symlink following and pre-creation race conditions in shared directories like /tmp or /dev/shm. This can lead to unauthorized local read access to IPC payloads.

Data::SpatialHash::Shared versions before 0.02 for Perl create a memory-mapped backing file with overly permissive permissions (world-readable) and open it without safeguards against symlink attacks or race conditions. This allows local users to read inter-process communication payloads and potentially manipulate the file open operation by pre-creating files or symlinks at the target path.

Data::Intern::Shared versions before 0.02 for Perl create a memory-mapped file with overly permissive permissions (world-readable) and open it without secure flags, allowing local users to read sensitive IPC data or exploit race conditions via symlink attacks. The file is created with mode 0666 but typically results in 0644 permissions due to umask, and lacks O_EXCL and O_NOFOLLOW flags, enabling pre-creation races and symlink following in shared directories like /tmp or /dev/shm.

Data::RingBuffer::Shared versions before 0.04 for Perl create a memory-mapped backing file with world-readable permissions and open it without using secure flags O_EXCL or O_NOFOLLOW. This allows local users to read inter-process communication payloads stored in the shared segment and enables local attackers to exploit race conditions or symlink attacks to redirect file access. The vulnerability arises from incorrect permission assignment and insecure file opening practices in a shared directory.

Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in roaring.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.

Data::HashMap::Shared versions before 0.14 for Perl create a world-readable memory-mapped file without exclusive or no-follow flags, allowing local users to read IPC payloads and potentially exploit symlink or pre-creation race conditions in shared directories like /tmp or /dev/shm.

Data::RadixTree::Shared versions prior to 0.02 for Perl create a memory-mapped file with overly permissive permissions (world-readable) and open it without safeguards against symlink attacks or race conditions. This allows local users to read inter-process communication data and potentially exploit pre-creation or symlink redirection attacks. The vulnerability arises from the use of open() with mode 0666 and missing O_EXCL and O_NOFOLLOW flags.

Data::SortedSet::Shared versions before 0.03 for Perl create a memory-mapped backing file with overly permissive permissions (world-readable) and open it without secure flags O_EXCL or O_NOFOLLOW. This allows local users to read sensitive IPC payloads and potentially exploit race conditions or symlink attacks by pre-creating or redirecting the backing file in shared directories like /tmp or /dev/shm.