========================================================================
CVE-2026-59145                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-59145
   Distribution:  Data-Intern-Shared
       Versions:  before 0.02

       MetaCPAN:  https://metacpan.org/dist/Data-Intern-Shared
       VCS Repo: https://github.com/vividsnow/perl5-data-intern-shared

Data::Intern::Shared versions before 0.02 for Perl allow an
out-of-bounds read via unvalidated slot, reverse and arena indices in
si_idx_find

Description
-----------
Data::Intern::Shared versions before 0.02 for Perl allow an
out-of-bounds read via unvalidated slot, reverse and arena indices in
si_idx_find.

The attach-time validator si_validate_header is thorough about the
header and layout (magic, version, section offsets, total_size, count
and arena_used) but does not validate the three arrays it then trusts.
Every lookup in si_idx_find walks a triple indirection read straight
from the mmap'd segment, arena[reverse[slots[i].id]], with no bound on
slots[i].id against count, on the reverse[id] arena offset against
arena_used, or on the arena record's length prefix.

A local peer that can write the backing file can leave the header valid
while poisoning a slot id, a reverse offset or an arena length prefix,
so an id_of, intern or string lookup dereferences the chain out of
bounds; because string() returns a file-controlled length of bytes from
the arena, adjacent process memory can be disclosed.

Problem types
-------------
- CWE-125 Out-of-bounds Read

Workarounds
-----------
For deployments that cannot upgrade to 0.02, place the backing file in
a directory writable only by the owning user, so a local peer cannot
tamper with the slot, reverse and arena contents the lookup path reads.

Solutions
---------
Upgrade to Data::Intern::Shared 0.02 or later, which bounds the slot
id, the reverse offset and the record length before each dereference
and caps the hash-slot probe.

References
----------
https://metacpan.org/release/EGOR/Data-Intern-Shared-0.02/diff/EGOR/Data-Intern-Shared-0.01#intern.h
https://metacpan.org/release/EGOR/Data-Intern-Shared-0.02/changes