CVE-2026-65067

Executive Summary

This report details CVE-2026-65067, a vulnerability in the Perl module Data::Intern::Shared affecting versions before 0.02. The vulnerability is classified as Informational due to a CVSS base score of 0.0, reflecting its local-only attack vector and limited impact on confidentiality. The core issue lies in the creation of a world-readable memory-mapped (mmap) backing file without the use of O_EXCL or O_NOFOLLOW flags during the open() system call.

The business impact is primarily confined to multi-tenant environments or shared hosting platforms where local users share the same filesystem. An attacker with local access to the system could read inter-process communication (IPC) payloads from the shared memory segment, potentially leaking sensitive data processed by other applications using this module. The likely attacker is a local user with non-privileged access, such as a malicious insider or a user who has compromised a low-privilege account.

The urgency is assessed as low based on the CVSS score of 0.0 and an EPSS exploitation probability of 0.0%. No active exploitation in the wild has been reported, and no public proof-of-concept code is available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Key Facts:

• Vendor: Data::Intern::Shared (Perl module)
• Affected Versions: < 0.02
• Patch Status: Unpatched (no official fix version confirmed)
• Attack Vector: Local
• CWE: CWE-377 (Insecure Temporary File)

CVSS Breakdown & Threat Level

The CVSS v3.1 base score is 0.0, which maps to the qualitative severity label Informational.

Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Metric Decomposition:

• AV:L (Attack Vector: Local): The attacker must have local access to the system to exploit the world-readable file or plant a symlink. The vulnerability is not exploitable over a network.
• AC:L (Attack Complexity: Low): No special conditions or race conditions beyond the basic file creation race are required. The default umask of 022 reliably creates a world-readable file.
• PR:L (Privileges Required: Low): The attacker only needs standard user-level privileges on the system. No root or administrative access is required.
• UI:N (User Interaction: None): The victim application does not need to perform any action beyond its normal operation for the vulnerability to be exploited.
• S:U (Scope: Unchanged): An exploit cannot affect resources beyond the security authority of the vulnerable component. The attacker's access is limited to the shared memory segment of the vulnerable process.
• C:L (Confidentiality: Low): The attacker can read the IPC payloads stored in the world-readable mmap backing file. There is no impact on integrity or availability.
• I:N (Integrity: None): The vulnerability does not allow modification of data.
• A:N (Availability: None): The vulnerability does not affect system or application availability.

EPSS Interpretation: The EPSS score of 0.0% indicates that, as of the report date, there is no observed exploitation activity in the wild. This is consistent with the lack of public PoC and the low severity of the vulnerability.

Historical Comparison: This vulnerability is similar to other insecure temporary file issues (CWE-377) found in various software, such as older versions of tmpwatch or mktemp implementations. The core flaw—predictable file paths and world-readable permissions—is a classic local information disclosure vector.

Temporal & Environmental Considerations: The score remains 0.0 as there is no patch, no exploit code, and no official remediation guidance. In an environment with strict filesystem permissions (e.g., /tmp mounted with noexec and nosuid, or using private /tmp directories per user), the practical risk is reduced.

Technical Deep Dive & Attack Mechanics

The vulnerability resides in the intern.h file of the Data::Intern::Shared module. The core issue is the insecure creation of a shared memory backing file.

Step-by-Step Exploitation:

1. File Creation: When a Perl application uses Data::Intern::Shared to create a shared memory segment, the module calls open(path, O_RDWR|O_CREAT, 0666).
2. World-Readable Permissions: The mode 0666 is specified. Under a typical Linux umask of 022, this results in the file being created with permissions 0644 (rw-r--r--). This makes the file readable by any user on the system.
3. Missing O_EXCL: The O_EXCL flag is absent. This means if a file already exists at the target path, the open() call will succeed and open the existing file instead of failing. This allows a local attacker to pre-create a file at the expected path, potentially controlling the shared memory segment.
4. Missing O_NOFOLLOW: The O_NOFOLLOW flag is absent. This means if a symbolic link exists at the target path, the open() call will follow the symlink. An attacker can plant a symlink pointing to a sensitive file (e.g., /etc/passwd or another user's data file) to redirect the shared memory operations.
5. Shared Directory: The shared memory segment is typically created in a world-writable directory like /tmp or /dev/shm. This makes the path predictable and accessible to all local users.

Attack Surface:

• Local File System: The vulnerability is exploitable only from the local system.
• IPC Payloads: The attacker can read the contents of the mmap backing file, which contains the data being shared between processes. This could include session tokens, cryptographic keys, or other sensitive application data.

Pre-conditions for Exploitation:

• The attacker must have a local user account on the system.
• A process must be actively using Data::Intern::Shared to create a shared memory segment.
• The target directory (e.g., /tmp) must be accessible to the attacker.

Why Standard Defenses May Fail:

• File Permissions: Standard file permission controls are bypassed because the module explicitly requests world-readable permissions.
• Symlink Protections: Without O_NOFOLLOW, standard symlink protections (like protected_symlinks sysctl) may not prevent the attack if the attacker owns the symlink and the target file is accessible.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (in intern.h):

int fd = open(path, O_RDWR | O_CREAT, 0666);

Patched Code (Expected):

int fd = open(path, O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW, 0600);

Analysis:

• O_EXCL: Ensures that the open() call fails if the file already exists. This prevents a pre-creation race condition where an attacker creates a file at the expected path before the legitimate process.
• O_NOFOLLOW: Ensures that the open() call fails if the path is a symbolic link. This prevents an attacker from redirecting the shared memory segment to a different file.
• Mode 0600: Changes the file permissions to owner-read/write only, preventing other users on the system from reading the IPC payloads.

Regression Considerations: The patch is a minimal and safe change. Adding O_EXCL and O_NOFOLLOW is a standard security hardening practice. Changing the mode to 0600 may break applications that legitimately need to share data between processes running as different users, but this is an unlikely use case for a shared memory module.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-21T20:17:05.733
• Estimated Discovery: The vulnerability was likely discovered through code review or static analysis, given the obvious insecure file creation pattern.
• Disclosure Process: The CVE was assigned and published by the CNA. No vendor coordination or advisory details are available in the provided data.
• Known Exploitation: No known active exploitation as of 2026-07-21.
• CISA KEV: Not listed.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Malicious Insiders: A user with legitimate access to a shared system who wants to exfiltrate data from other users' processes.
• Low-Sophistication Attackers: Script kiddies or automated malware that has gained a foothold on a system and is looking for local privilege escalation or information disclosure opportunities.

Attack Campaign Context: There are no known campaigns specifically targeting this CVE. It is a low-severity, local-only vulnerability.

Industry Verticals at Risk:

• Shared Hosting Providers: Environments where multiple customers share the same physical or virtual server.
• Multi-Tenant SaaS Platforms: Applications that run multiple customer workloads on the same operating system instance.
• Academic/Research Environments: Shared computing clusters where users run arbitrary code.

Connection to Similar Vulnerabilities: This is a classic example of CWE-377 (Insecure Temporary File), which has been exploited in many other contexts, such as the tmpwatch race condition (CVE-2005-0394) and various mktemp vulnerabilities.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: A Linux virtual machine (e.g., Ubuntu 22.04) with two user accounts: victim and attacker.
2. Install Vulnerable Module: Install Data::Intern::Shared version 0.01 (or any version < 0.02).

   # As root
   cpanm Data::Intern::Shared@0.01
   

3. Victim Script: Create a script that uses the vulnerable module to share data.

   # victim.pl
   use Data::Intern::Shared;
   my $shared = Data::Intern::Shared->new( key => 'my_secret_data' );
   $$shared = 'Sensitive API Key: sk-1234abcd';
   sleep(3600); # Keep running
   

4. Run Victim: Execute the victim script as the victim user.

   su - victim -c "perl victim.pl &"
   

Exploitation Walkthrough:

1. Identify the Backing File: As the attacker user, find the mmap backing file created by the victim process.

   ls -la /tmp/*.dat  # Or check /dev/shm
   

2. Read the File: The file will be world-readable (e.g., -rw-r--r--). Read its contents.

   cat /tmp/Data-Intern-Shared-my_secret_data.dat
   

3. Expected Output: The file will contain the serialized shared data, including the sensitive API key.

Post-Exploitation: The attacker can now use the leaked API key to access the target application's backend services.

Blue Team Section

Detection:

• File Permission Anomalies: Monitor for the creation of files in /tmp or /dev/shm with world-readable permissions (mode 0644 or 0666) that are associated with Perl processes.
• Process Monitoring: Monitor for Perl processes that open files with O_CREAT and mode 0666 in shared directories.
• Auditd Rules: Use auditd to log file opens with specific flags.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

• File System Artifacts:
  • Files in /tmp or /dev/shm matching the pattern Data-Intern-Shared-*.dat with permissions 0644.
• Process Execution:
  • Perl processes executing Data::Intern::Shared module.
• Log Entries:
  • Audit logs showing open() calls with O_CREAT and mode 0666 on files in /tmp or /dev/shm.

Detection Engineering

YARA Rule

rule CVE_2026_65067_Data_Intern_Shared {
    meta:
        description = "Detects exploitation of CVE-2026-65067 in Data::Intern::Shared"
        author = "Valters IT Hub"
        date = "2026-07-21"
        reference = "https://www.valtersit.com/cve/cve-2026-65067"
    strings:
        $s1 = "O_RDWR|O_CREAT" ascii wide nocase
        $s2 = "0666" ascii wide nocase
    condition:
        all of them
}

Sigma Rule (SIEM)

title: CVE-2026-65067 Data::Intern::Shared Exploitation Detection
id: 7004e8ef-aeec-458d-b7c1-cb3f59052982
status: experimental
description: Detects exploitation attempts targeting CVE-2026-65067 in Data::Intern::Shared
author: Valters IT Hub
date: 2026-07-21
references:
    - https://www.valtersit.com/cve/cve-2026-65067
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|contains: '/tmp/Data-Intern-Shared-'
        TargetFilename|endswith: '.dat'
        FilePermissions: '0644'
    condition: selection
falsepositives:
    - Legitimate administrative activity where a user manually creates a world-readable file in /tmp
level: high

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-65067 Data::Intern::Shared Exploitation"; content:"Data-Intern-Shared"; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Elastic (EQL) Query

file where event.action == "creation" and file.path : "/tmp/Data-Intern-Shared-*.dat" and file.permissions : "0644"

Splunk SPL Query

index=linux sourcetype=linux:audit
| search "open" "O_CREAT" "0666" "/tmp/Data-Intern-Shared-"
| table _time, host, user, process, file_name

Wazuh Rule

<group name="syscheck,">
  <rule id="100001" level="10">
    <if_sid>550</if_sid>
    <field name="file">/tmp/Data-Intern-Shared-</field>
    <description>CVE-2026-65067: World-readable Data::Intern::Shared file detected</description>
    <options>no_full_log</options>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours):

• Patch: Upgrade to Data::Intern::Shared version 0.02 or later as soon as it is available.
• Compensating Control: If patching is not possible, restrict access to the shared directories (/tmp, /dev/shm) using filesystem ACLs or by mounting them with the mode=0700 option (though this may break other applications).
• Network-Level: No network-level mitigation is applicable as this is a local vulnerability.
• Authentication Hardening: Ensure that only trusted users have local access to production systems.

Short-term (1-7 days):

• Configuration Hardening: Implement a custom umask of 077 for all Perl processes using Data::Intern::Shared to mitigate the world-readable file issue.
• Monitoring: Deploy the detection rules provided in this report to monitor for exploitation attempts.
• Vulnerability Scanning: Use a local vulnerability scanner to identify systems with the vulnerable module installed.

  # Check installed version
  perl -MData::Intern::Shared -e 'print $Data::Intern::Shared::VERSION'
  

Long-term:

• Architecture Changes: Consider using more secure IPC mechanisms, such as Unix domain sockets with proper permissions, instead of shared memory.
• Developer Training: Educate developers on secure file creation practices, including the use of O_EXCL, O_NOFOLLOW, and restrictive file modes.

Validation:

• Confirm the patch by checking the module version.

  perl -MData::Intern::Shared -e 'print $Data::Intern::Shared::VERSION'
  

• Verify that no world-readable files matching the pattern Data-Intern-Shared-*.dat exist in /tmp or /dev/shm.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65067
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-65067
• Vendor advisory: See vendor security page
• OSV: https://osv.dev/vulnerability/CVE-2026-65067 (if applicable)
• Related CWE: https://cwe.mitre.org/data/definitions/377.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1547/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-21 | https://www.valtersit.com/cve/cve-2026-65067