A critical out-of-bounds read vulnerability in the Perl module Data::Intern::Shared allows unauthenticated attackers to potentially disclose adjacent process memory.

The vulnerability exists because the software fails to validate indices used in the si_idx_find function, allowing an attacker to trigger an out-of-bounds read. This flaw is reachable by an unauthenticated actor who can modify the backing file, leading to the disclosure of sensitive data from adjacent process memory.

The exploitation of this vulnerability poses a significant risk to data confidentiality, as it enables unauthorized disclosure of memory contents. Given the critical CVSS score of 9.1, this flaw could be leveraged to extract sensitive information or cryptographic keys from affected systems, potentially resulting in severe security breaches and loss of system integrity.

Immediate Action: Upgrade the Data::Intern::Shared module to version 0.02 or later, which implements necessary bounds checking on slot IDs, reverse offsets, and record lengths.

Proactive Monitoring: Monitor system logs for unusual file access patterns or unexpected memory access errors in applications utilizing the Data::Intern::Shared module.

Compensating Controls: Ensure that access to the shared backing files is strictly restricted at the filesystem level to prevent unauthorized modification by local, lower-privileged users.

Public Exploit Available: No

Organizations utilizing the Data::Intern::Shared module in Perl environments must prioritize the update to version 0.02 immediately. Because this vulnerability allows for unauthorized memory disclosure without requiring authentication, the risk of data compromise is high, necessitating swift patching across all affected production and development environments.