CVE-2026-59145: Perl Data::Intern::Shared Info Leak

CVE-2026-59145 Overview

CVE-2026-59145 is an out-of-bounds read vulnerability in the Data::Intern::Shared Perl module before version 0.02. The flaw resides in the si_idx_find lookup routine, which trusts three arrays inside a shared memory-mapped segment without validating their contents. A peer with write access to the backing file can poison a slot identifier, a reverse offset, or an arena record length prefix while keeping the header valid. Subsequent id_of, intern, or string calls follow the triple indirection out of bounds and return attacker-controlled numbers of bytes from adjacent process memory, disclosing sensitive data. The issue is tracked under [CWE-125: Out-of-bounds Read].

Critical Impact
Memory disclosure of adjacent process memory through crafted shared-file entries, potentially exposing secrets, cryptographic material, and other confidential runtime data.

Affected Products

Data::Intern::Shared for Perl, all versions before 0.02
Perl applications that consume shared interned string segments via this module
Multi-process deployments where the backing mmap file is writable by another local peer

Discovery Timeline

2026-07-21 - CVE-2026-59145 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-59145

Vulnerability Analysis

The Data::Intern::Shared module implements a shared string interning table backed by an mmap'd file. The attach-time validator si_validate_header inspects the header and layout thoroughly, checking magic bytes, version, section offsets, total_size, count, and arena_used. However, it never validates the three arrays those fields describe: the slots array, the reverse index, and the arena payload.

Each lookup in si_idx_find walks a triple indirection expression, arena[reverse[slots[i].id]], reading each level directly from the mapped segment. The code does not bound slots[i].id against count, does not check reverse[id] against arena_used, and does not validate the length prefix of the arena record it lands on. Any process that can write the shared file can therefore steer string() to read a caller-controlled byte count from an arbitrary offset within the mapping.

Root Cause

The root cause is missing bounds validation on data trusted after header verification. The header validator confirms structural integrity but not array element integrity. The code assumes that once the header is well formed, the interior indices are safe, which fails whenever the backing file is writable by an adversary.

Attack Vector

A local peer with write access to the shared backing file crafts a poisoned entry: a slot id larger than count, a reverse offset outside arena_used, or an arena length prefix that exceeds the record. When any consumer performs id_of, intern, or string, the pointer chain dereferences out of bounds and string() returns file-controlled bytes from adjacent process memory to the calling Perl code.

No exploitation code is published for this issue. See the MetaCPAN Release Diff for the corrective validation logic added in 0.02.

Detection Methods for CVE-2026-59145

Indicators of Compromise

Unexpected writes to Data::Intern::Shared backing files by processes other than the owning application.
Perl processes returning unusually long or non-textual byte strings from intern lookups.
Segmentation faults or SIGBUS in Perl workers referencing the shared intern segment.
Anomalous file permissions granting write access on the shared mmap file to non-owner accounts.

Detection Strategies

Audit installed CPAN modules and flag any version of Data::Intern::Shared earlier than 0.02.
Monitor file integrity on the shared backing file and alert on modifications by unexpected UIDs.
Instrument Perl workloads to log lookups that return oversized string payloads from the intern table.

Monitoring Recommendations

Enable process and file telemetry on hosts running Perl services that use shared interning.
Track open/write syscalls against the mmap-backed file path and correlate with the parent process identity.
Alert on new local accounts or group memberships that gain write access to directories containing intern segments.

How to Mitigate CVE-2026-59145

Immediate Actions Required

Upgrade Data::Intern::Shared to version 0.02 or later on every host that consumes the module.
Restrict write permissions on the shared backing file to the single owning service account.
Move the backing file to a directory that is not writable by other local users or containers.
Rebuild and redeploy Perl applications that statically bundle the vulnerable module.

Patch Information

The fix is available in Data::Intern::Shared0.02. The updated release adds bounds validation on slot identifiers, reverse offsets, and arena length prefixes before dereferencing them in si_idx_find. Release notes and the source diff are available on MetaCPAN Release Changes and MetaCPAN Release Diff.

Workarounds

Set the backing file mode to 0600 and ensure it is owned by the service UID only.
Isolate consumer processes in dedicated user namespaces or containers so no untrusted peer shares the mount.
Disable use of Data::Intern::Shared in security-sensitive contexts until the upgrade to 0.02 is complete.

bash

# Configuration example: upgrade and lock down the backing file
cpanm Data::Intern::Shared@0.02
chown appuser:appgroup /var/lib/myapp/intern.shared
chmod 0600 /var/lib/myapp/intern.shared