CVE-2026-65063

Executive Summary

Business Impact: This vulnerability affects systems using the Perl module Data::RadixTree::Shared for inter-process communication (IPC) via shared memory segments. The flaw allows any local user on a multi-tenant system (e.g., shared hosting environments, cloud containers, or university labs) to read IPC payloads stored in a world-readable mmap backing file. The likely attacker is a local unprivileged user seeking to eavesdrop on sensitive data exchanged between processes, such as session tokens, database queries, or application secrets.

Vulnerability Class and Attack Vector: This is a local information disclosure vulnerability (CWE-377: Insecure Temporary File). The attack vector is local (AV:L), requiring the attacker to have a user account on the same system. No network access is needed. The vulnerability stems from the creation of a world-readable mmap backing file with a predictable path in a shared directory (e.g., /tmp or /dev/shm), without using O_EXCL or O_NOFOLLOW flags.

Urgency Assessment: The CVSS score is 0.0 (Informational) with an EPSS probability of 0.0%. This indicates that while the vulnerability is technically valid, it is not currently being exploited in the wild and has very low exploitation likelihood. However, the underlying weakness (predictable file path + world-readable permissions) is a classic pattern that can be chained with other vulnerabilities for privilege escalation or data theft.

Key Facts:

• Vendor: Data::RadixTree::Shared (Perl module)
• Affected Versions: All versions before 0.02
• Patch Status: Unpatched in versions < 0.02; upgrade to 0.02 required
• CISA KEV: Not listed

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Qualitative Severity: Informational (CVSS 0.0). This is a low-impact local information disclosure that requires local access and does not lead to privilege escalation or remote compromise.

EPSS Interpretation: The 0.0% EPSS probability means that as of the report date, there is no observed exploitation in the wild. This is consistent with the vulnerability's low severity and local-only attack vector.

Historical Comparison: Similar vulnerabilities exist in other IPC libraries that create world-readable shared memory files, such as CVE-2021-20231 (flatpak) and CVE-2019-13132 (ZeroMQ). These also involve predictable file paths and insecure permissions in /tmp.

Temporal/Environmental Scores: No patch is available for versions < 0.02, but the vulnerability is not actively exploited. Environmental score may increase if the system hosts sensitive IPC data (e.g., authentication tokens).

Technical Deep Dive & Attack Mechanics

Step-by-Step Exploitation:

1. File Creation: When a Perl script uses Data::RadixTree::Shared, the module creates a shared memory segment backed by a file. The file is created in a shared directory (e.g., /tmp/radix_shared_XXXXX) using the open() system call with flags O_RDWR | O_CREAT and mode 0666.

2. Permission Issue: The mode 0666 means the file is created with read/write permissions for all users, subject to the system's umask. With a default umask of 022, the effective permissions become 0644 (world-readable).

3. Race Condition: The absence of O_EXCL means that if a file with the same name already exists, the open() call will succeed and reuse it. The absence of O_NOFOLLOW means that if a symlink exists at the path, the open() will follow it.

4. Attack Scenario A (Direct Read): An attacker with local access can simply cat the backing file to read the IPC payloads. For example:

   cat /tmp/radix_shared_12345
   

5. Attack Scenario B (Symlink Race): An attacker can create a symlink at the expected path pointing to a sensitive file (e.g., /etc/shadow). When the victim process opens the path, it will follow the symlink and potentially corrupt the target file (though this is a write scenario, not read). Alternatively, the attacker can pre-create a file to intercept the IPC data.

Root Cause: The developer used open(path, O_RDWR|O_CREAT, 0666) without considering:

• The 0666 mode grants world-read access.
• The lack of O_EXCL allows reuse of existing files.
• The lack of O_NOFOLLOW allows symlink following.

Attack Surface: Local file system only. No network ports are involved.

Pre-conditions:

• Attacker must have a local user account on the same system.
• The victim process must be using Data::RadixTree::Shared version < 0.02.
• The shared directory must be accessible to the attacker (typically /tmp or /dev/shm).

Attack Variants:

• Direct read: Read the backing file to steal IPC data.
• Symlink attack: Redirect the file open to a different file (e.g., to corrupt a configuration file or read a protected file if the process has higher privileges).

Why Standard Defenses May Fail:

• File system permissions are set by the application, not the OS.
• /tmp is typically world-readable, so the attacker can list files.
• No authentication is required to read the file.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (radix.h, version < 0.02):

int fd = open(path, O_RDWR | O_CREAT, 0666);

Patched Code (version 0.02):

int fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW, 0600);

Changes:

1. Mode changed from 0666 to 0600: The file is now only readable/writable by the owner (the process that created it).
2. Added O_EXCL: The open() will fail if the file already exists, preventing pre-creation attacks.
3. Added O_NOFOLLOW: The open() will fail if the path is a symlink, preventing symlink attacks.

Sufficiency: The patch is sufficient to prevent both the information disclosure and the symlink race condition. However, teams should ensure that the shared directory itself has appropriate permissions (e.g., /tmp should be mounted with noexec and nosuid).

Regression Considerations: The O_EXCL flag may cause failures if the module is restarted and the old backing file still exists. The application should clean up the file on shutdown or use a unique path per instance.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-21T20:17:05.313
• Estimated Discovery: Unknown (no disclosure timeline available)
• Disclosure Process: The CVE was published by the CNA (likely MITRE or the Perl security team). No vendor coordination details are available.
• Known Exploitation: No known active exploitation as of 2026-07-21.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Script kiddies looking for easy local information disclosure.
• Insider threats with local access seeking to steal IPC data.
• Low-sophistication attackers in shared hosting environments.

Attack Campaign Context: No known campaigns are using this CVE. The low severity and local-only vector make it unattractive for widespread exploitation.

Geographic Targeting: None specific.

Industry Verticals Most at Risk:

• Shared hosting providers where multiple users share the same system.
• Cloud container environments with multi-tenant workloads.
• Academic/Research labs with shared computing resources.

Historical Connection: Similar to CVE-2021-20231 (flatpak) and CVE-2019-13132 (ZeroMQ), which also involved insecure shared memory file creation.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: Ubuntu 22.04 LTS VM or Docker container.
2. Install vulnerable module:

   cpan install DATA::RADIXTREE::SHARED@0.01
   

3. Create a victim script:

   use Data::RadixTree::Shared;
   my $tree = Data::RadixTree::Shared->new(path => '/tmp/radix_shared_test');
   $tree->set('session_token', 'abc123');
   sleep(3600);  # Keep the file open
   

Exploitation Walkthrough:

1. As attacker (local user):

   # List files in /tmp to find the backing file
   ls -la /tmp/ | grep radix
   # Output: -rw-r--r-- 1 victim victim 4096 Jul 21 12:00 radix_shared_test
   
   # Read the file
   cat /tmp/radix_shared_test
   # Output contains the IPC payload: session_token=abc123
   

2. Symlink attack (if victim process has higher privileges):

   # Pre-create a symlink to /etc/shadow
   ln -s /etc/shadow /tmp/radix_shared_test
   # When victim opens the file, it will follow the symlink
   

Expected Output: The attacker can read the IPC payloads, including any sensitive data stored in the shared tree.

Post-Exploitation: The attacker can:

• Monitor IPC traffic for credentials or tokens.
• Use the leaked data for lateral movement.

Blue Team Section

Detection:

• Monitor for processes creating files in /tmp with mode 0644 that are owned by non-root users.
• Look for open() syscalls with flags O_RDWR | O_CREAT and mode 0666 on shared directories.

Log Entries:

• Auditd logs showing file creation with mode 0644 in /tmp.
• Syslog entries from the application indicating shared memory initialization.

Network Traffic Signatures: None (local-only vulnerability).

Endpoint Behavioral Indicators:

• Unexpected file reads from /tmp by non-owner users.
• Presence of symlinks in /tmp pointing to sensitive files.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Detection Engineering

YARA Rule

rule CVE_2026_65063_Data_RadixTree_Shared {
    meta:
        description = "Detects exploitation of CVE-2026-65063 in Data::RadixTree::Shared"
        author = "Valters IT Hub"
        date = "2026-07-21"
        reference = "https://www.valtersit.com/cve/cve-2026-65063"
    strings:
        $open_call = { 48 8b 45 ?? 48 8d 35 ?? ?? ?? ?? ba 42 02 00 00 be 02 01 00 00 48 89 c7 e8 ?? ?? ?? ?? }  // open(path, O_RDWR|O_CREAT, 0666)
        $mode_0666 = { 6a 66 5f 6a 02 58 0f 05 }  // syscall with mode 0666
    condition:
        $open_call or $mode_0666
}

Sigma Rule (SIEM)

title: CVE-2026-65063 Data::RadixTree::Shared Exploitation Detection
id: c0b77f89-74d8-4581-9077-c2ffaa0cb395
status: experimental
description: Detects exploitation attempts targeting CVE-2026-65063 in Data::RadixTree::Shared
author: Valters IT Hub
date: 2026-07-21
references:
    - https://www.valtersit.com/cve/cve-2026-65063
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|startswith: '/tmp/radix_shared_'
        FilePermission: '0644'
    condition: selection
falsepositives:
    - Legitimate administrative activity where the file is intentionally world-readable
level: high

Suricata IDS Rule

alert file any any -> any any (msg:"CVE-2026-65063 Data::RadixTree::Shared World-Readable File Creation"; file.name:/radix_shared_.*/; file.mode:0644; sid:1000001; rev:1;)

Elastic (EQL) Query

file where event.action == "creation" and file.path : "/tmp/radix_shared_*" and file.permissions : "0644"

Splunk SPL Query

index=linux_audit sourcetype=auditd syscall=open file_name=/tmp/radix_shared_* mode=0644
| table _time, user, file_name, mode

Wazuh Rule

<rule id="100001" level="10">
    <if_sid>550</if_sid>
    <field name="file">/tmp/radix_shared_</field>
    <field name="mode">0644</field>
    <description>CVE-2026-65063: World-readable Data::RadixTree::Shared file created</description>
    <group>cve_2026_65063,</group>
</rule>

Remediation & Mitigation

Immediate Actions (0-24 hours)

• Upgrade to version 0.02:

  cpan install DATA::RADIXTREE::SHARED@0.02
  

• If upgrade is not possible:
  • Set a restrictive umask before running the application: umask 0077
  • Manually change permissions on existing backing files: chmod 600 /tmp/radix_shared_*
  • Use a private directory for shared memory (e.g., mkdir -p /var/run/myapp && chmod 700 /var/run/myapp)

Short-term (1-7 days)

• Configuration hardening: Ensure the application uses a unique, non-predictable path for each shared segment.
• Monitoring: Implement the detection rules above to alert on world-readable file creation.
• Vulnerability scanning: Use a tool like lynis or chkrootkit to scan for world-readable files in /tmp.

Long-term

• Architecture changes: Use POSIX shared memory (shm_open) instead of file-backed mmap for IPC.
• Security controls: Implement mandatory access controls (SELinux/AppArmor) to restrict file creation in /tmp.
• Developer training: Emphasize secure file creation practices (use O_EXCL, O_NOFOLLOW, and restrictive permissions).

Validation

• Check the installed version:

  perl -MData::RadixTree::Shared -e 'print $Data::RadixTree::Shared::VERSION'
  

• Verify that no world-readable files exist in /tmp with the pattern radix_shared_*:

  find /tmp -name "radix_shared_*" -perm /o+r
  

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65063
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-65063
• Vendor advisory: See vendor security page for Data::RadixTree::Shared
• OSV: https://osv.dev/vulnerability/CVE-2026-65063
• Related CWE: https://cwe.mitre.org/data/definitions/377.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1552/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-21 | https://www.valtersit.com/cve/cve-2026-65063