CVE-2026-65065

SHADOW_DORKS: []

Executive Summary

CVE-2026-65065 is a Informational severity vulnerability in the Perl module Data::RoaringBitmap::Shared affecting versions before 0.02. The vulnerability arises from insecure file creation and handling of shared memory-mapped (mmap) backing files. The module creates a world-readable file with mode 0666 (resulting in 0644 under a default umask of 022) and opens it without the O_EXCL or O_NOFOLLOW flags. This allows any local user on a multi-tenant system to read the Inter-Process Communication (IPC) payloads stored in the segment, and a local attacker can win a pre-creation race condition or plant a symlink to redirect the open call to an attacker-controlled file.

The attack vector is strictly local, requiring the attacker to have a user account on the same host as the victim process. The business impact is primarily on shared hosting environments, high-performance computing (HPC) clusters, or any system where multiple users share a filesystem (e.g., /tmp or /dev/shm). The likely attacker is a local user seeking to escalate privileges or leak sensitive data from another user's process.

With a CVSS score of 0.0 and an EPSS probability of 0.0%, the urgency for immediate patching is low. However, the vulnerability represents a fundamental security flaw in the module's design that should be addressed to prevent information disclosure in multi-tenant environments. No patch is currently available from the vendor.

CVSS Breakdown & Threat Level

Qualitative Severity: Informational

The CVSS vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The base score is 0.0.

• AV:L (Local): The attacker must have local access to the system to exploit the vulnerability. They cannot exploit it over a network.
• AC:L (Low): The attack complexity is low. The attacker simply needs to create a file or symlink in the shared directory before the victim process, or read the world-readable backing file.
• PR:L (Low): The attacker requires low-level privileges—specifically, a local user account on the system.
• UI:N (None): No user interaction from the victim is required beyond the normal operation of the vulnerable software.
• S:U (Unchanged): A successful attack does not change the scope of the vulnerable component.
• C:L (Low): There is a low impact on confidentiality. The attacker can read the IPC payloads, which may contain sensitive data, but the impact is limited to the contents of the shared memory segment.
• I:N (None): There is no impact on integrity.
• A:N (None): There is no impact on availability.

EPSS Interpretation: The EPSS probability of 0.0% indicates that, as of the report date, there is no observed exploitation in the wild. This is consistent with the vulnerability being recently disclosed and requiring local access.

Historical Comparison: This vulnerability is similar to CWE-377 (Insecure Temporary File) issues found in other Perl modules and applications that create files in shared directories without proper flags. Examples include vulnerabilities in older versions of File::Temp and various CGI scripts that created predictable temporary files.

Technical Deep Dive & Attack Mechanics

Root Cause Analysis: The developer made two critical mistakes when creating the shared memory backing file in roaring.h:

1. World-Readable Permissions: The open() call uses mode 0666. Under a default umask of 022, this creates a file with permissions 0644 (world-readable). This allows any local user to read the file's contents, which contain the IPC payloads.
2. Missing Security Flags: The open() call does not include O_EXCL or O_NOFOLLOW. The absence of O_EXCL means the open will succeed even if the file already exists, allowing a pre-creation race. The absence of O_NOFOLLOW means the open will follow a symlink, allowing an attacker to redirect the open to an arbitrary file.

Step-by-Step Exploitation:

1. Pre-creation Race: An attacker monitors the /tmp or /dev/shm directory for the creation of the backing file by a victim process. The attacker creates a file with the same name before the victim's open() call. Because O_EXCL is not set, the victim's open() succeeds, and the attacker can read the file's contents.
2. Symlink Attack: An attacker creates a symlink with the same name as the expected backing file, pointing to a file the attacker controls (e.g., /etc/passwd). When the victim process calls open(), it follows the symlink and writes the IPC payloads to the attacker-controlled file, or reads from it, depending on the attack goal.
3. Information Disclosure: Once the backing file is created, any local user can read it because it is world-readable. The attacker can then parse the mmap data to extract sensitive information being shared between processes.

Attack Surface: The attack surface is limited to the local filesystem. The vulnerable function is in roaring.h, which is part of the Data::RoaringBitmap::Shared module.

Pre-conditions:

• The attacker must have a local user account on the same system as the victim.
• The victim process must use Data::RoaringBitmap::Shared to create a shared segment.
• The shared directory (e.g., /tmp or /dev/shm) must be accessible to the attacker.

Why Standard Defenses May Fail: Standard file permission controls (umask) are not sufficient because the module explicitly sets 0666. Filesystem auditing may not detect the race condition or symlink attack if not specifically configured to monitor for these patterns.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (roaring.h):

int fd = open(path, O_RDWR|O_CREAT, 0666);

This line creates or opens the file with world-readable permissions and no security flags.

Patched Code (Expected):

int fd = open(path, O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW, 0600);

The patch should:

• Add O_EXCL to fail if the file already exists, preventing the pre-creation race.
• Add O_NOFOLLOW to prevent symlink following.
• Change the mode to 0600 (owner read/write only) to prevent world-readability.

Regression Considerations: Changing the file creation mode from 0666 to 0600 may break functionality if other processes legitimately need to read the shared segment. The module should use a more secure IPC mechanism (e.g., Unix domain sockets) or properly manage permissions.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-21T20:17:05.537
• Estimated Discovery: Unknown, but likely discovered through code review or security audit.
• Disclosure Process: The CVE was published by the CNA. No vendor coordination or patch is available as of the report date.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-21.
• CISA KEV Addition: Not applicable.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Insider Threats: Malicious users on shared systems seeking to access other users' data.
• Script Kiddies: Low-skill attackers using automated tools to scan for world-readable files in /tmp.
• APT Groups: In targeted attacks against HPC environments or shared hosting providers, where data exfiltration is the goal.

Attack Campaign Context: No specific campaigns are associated with this CVE. It is a standalone vulnerability.

Geographic Targeting: No specific geographic patterns.

Industry Verticals Most at Risk:

• Shared Web Hosting: Multiple users on the same server.
• High-Performance Computing (HPC): Multi-user clusters where shared memory is common.
• Cloud Environments: Multi-tenant virtual machines sharing a filesystem.

Connection to Similar Vulnerabilities: This is a classic CWE-377 (Insecure Temporary File) vulnerability, similar to those found in many applications that create temporary files in shared directories.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: A Linux virtual machine (e.g., Ubuntu 22.04) with two user accounts: victim and attacker.
2. Software: Install the vulnerable version of Data::RoaringBitmap (version < 0.02). Since this is a Perl module, install it via CPAN: cpan Data::RoaringBitmap.
3. Victim Script: Create a Perl script that uses Data::RoaringBitmap::Shared to create a shared segment.
4. Attacker Script: Create a script that monitors /tmp for the creation of the backing file and attempts to read it.

Exploitation Walkthrough:

1. As victim: Run the Perl script that creates a shared segment. The script will create a file in /tmp (e.g., /tmp/roaring_bitmap_XXXXX).
2. As attacker: Run a script that continuously lists files in /tmp and attempts to read any file matching the pattern roaring_bitmap_*. Because the file is world-readable, the attacker can read its contents.
3. Symlink Attack (Advanced): Before the victim runs their script, the attacker creates a symlink: ln -s /tmp/attacker_controlled_file /tmp/roaring_bitmap_XXXXX. When the victim's script runs, it will write the IPC payloads to the attacker-controlled file.

Expected Output: The attacker successfully reads the contents of the shared memory segment, which may contain sensitive data.

Post-Exploitation: The attacker can use the leaked data for further attacks, such as privilege escalation or lateral movement.

Blue Team Section

Detection:

• File System Monitoring: Monitor for the creation of files in /tmp with world-readable permissions (mode 0644) that match the pattern roaring_bitmap_*.
• Process Monitoring: Monitor for processes using mmap on files in /tmp that are world-readable.
• Auditd Rules: Use auditd to log open() calls with mode 0666 or 0644 in /tmp.

Log Entries:

• Syslog entries showing file creation with mode 0644.
• Auditd logs showing open() calls with O_CREAT and mode 0666.

Network Traffic Signatures: None. This is a local vulnerability.

Endpoint Behavioral Indicators:

• Unexpected processes reading files in /tmp matching the pattern.
• Processes creating symlinks in /tmp targeting system files.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Detection Engineering

YARA Rule

rule CVE_2026_65065_Data_RoaringBitmap_Shared {
    meta:
        description = "Detects exploitation of CVE-2026-65065 in Data::RoaringBitmap"
        author = "Valters IT Hub"
        date = "2026-07-21"
        reference = "https://www.valtersit.com/cve/cve-2026-65065"
    strings:
        $open_call = { 6F 70 65 6E 28 70 61 74 68 2C 20 4F 5F 52 44 57 52 7C 4F 5F 43 52 45 41 54 2C 20 30 36 36 36 29 } // open(path, O_RDWR|O_CREAT, 0666)
        $mode_0666 = { 30 36 36 36 } // 0666
    condition:
        $open_call or $mode_0666
}

Sigma Rule (SIEM)

title: CVE-2026-65065 Data::RoaringBitmap Exploitation Detection
id: 76bf632c-e2ac-4a1c-8428-1e3358dfc64c
status: experimental
description: Detects exploitation attempts targeting CVE-2026-65065 in Data::RoaringBitmap
author: Valters IT Hub
date: 2026-07-21
references:
    - https://www.valtersit.com/cve/cve-2026-65065
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|startswith: '/tmp/roaring_bitmap_'
        FileCreate|contains: '0644'
    condition: selection
falsepositives:
    - Legitimate administrative activity where a user intentionally creates a world-readable file in /tmp
level: high

Suricata IDS Rule

alert file any any -> any any (msg:"CVE-2026-65065 Data::RoaringBitmap Shared File Creation"; file.name:/tmp/roaring_bitmap_.*; file.mode:0644; sid:1000001; rev:1;)

Elastic (EQL) Query

file where event.action == "creation" and file.path : "/tmp/roaring_bitmap_*" and file.mode : "0644"

Splunk SPL Query

index=linux sourcetype=linux:audit type=SYSCALL syscall=open key=openat
| search file_name="/tmp/roaring_bitmap_*" mode=0666
| table _time, user, file_name, mode

Wazuh Rule

<group name="syscheck,">
  <rule id="100001" level="10">
    <if_sid>550</if_sid>
    <field name="file">/tmp/roaring_bitmap_</field>
    <description>CVE-2026-65065: World-readable file created by Data::RoaringBitmap</description>
    <options>no_full_log</options>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours):

• No patch available. As a compensating control, restrict access to /tmp and /dev/shm using filesystem ACLs or mount options (e.g., noexec, nosuid, nodev).
• Network-level mitigation: Not applicable (local vulnerability).
• Authentication/access control: Ensure that only trusted users have accounts on multi-tenant systems.

Short-term (1-7 days):

• Configuration hardening: Set a restrictive umask (e.g., 077) for all users to mitigate the world-readable file issue, though this may not prevent the race condition.
• Monitoring implementation: Deploy the detection rules provided in this report.
• Vulnerability scanning: Use a script to check for the presence of the vulnerable module: perl -MData::RoaringBitmap -e 'print $Data::RoaringBitmap::VERSION'. If the version is less than 0.02, the system is vulnerable.

Long-term:

• Architecture changes: Replace the use of Data::RoaringBitmap::Shared with a more secure IPC mechanism, such as Unix domain sockets or properly permissioned shared memory (e.g., shm_open with O_EXCL).
• Security control improvements: Implement mandatory access control (e.g., SELinux, AppArmor) to restrict file creation in shared directories.
• Developer training: Educate developers on secure file handling practices, including the use of O_EXCL, O_NOFOLLOW, and appropriate file permissions.

Validation: To confirm the patch is applied, check the version of Data::RoaringBitmap and verify that the open() call in roaring.h includes O_EXCL and O_NOFOLLOW and uses mode 0600.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65065
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-65065
• Vendor advisory: See vendor security page
• OSV: https://osv.dev/vulnerability/CVE-2026-65065 (if applicable)
• Related CWE: https://cwe.mitre.org/data/definitions/377.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1055/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-21 | https://www.valtersit.com/cve/cve-2026-65065