A critical out-of-bounds read vulnerability in the EGOR Data::ReqRep::Shared library allows unauthenticated attackers to read sensitive adjacent memory or crash the application process.

This vulnerability is an out-of-bounds read (CWE-125) occurring in the reqrep_recv_locked function, where raw offset and length values from an mmap segment are used in a memory copy operation without bounds checking against the arena capacity. The flaw allows an unauthenticated local peer with write access to the backing file to poison request slots, leading to unauthorized memory access or denial of service.

The exploitation of this vulnerability poses a significant risk to data confidentiality and system availability. By reading adjacent memory, an attacker may exfiltrate sensitive data stored within the process space, while the ability to trigger a crash results in service interruption. Given the CVSS score of 9.1, this vulnerability is classified as critical, necessitating immediate attention to prevent potential exploitation of inter-process communication channels.

Immediate Action: Upgrade the Data::ReqRep::Shared library to version 0.05 or later, which introduces necessary bounds validation to ensure that arena offsets and lengths do not exceed the allocated capacity.

Proactive Monitoring: Monitor system and application logs for unusual process terminations or segmentation faults that may indicate attempts to trigger a memory-related crash.

Compensating Controls: Restrict file system permissions on the backing files used by the library to ensure that only authorized entities can modify the shared memory segment.

Public Exploit Available: Unknown.

Given the critical nature of this memory safety flaw, administrators must prioritize updating the Data::ReqRep::Shared library to version 0.05 immediately. Ensuring that the library correctly validates all input from shared memory segments is essential to maintaining the integrity and confidentiality of the application process.