CyberRota Analysis
AI-GeneratedVersions of Data::RoaringBitmap::Shared for Perl prior to 0.02 are vulnerable to an out-of-bounds read due to improper validation of container offsets and cardinality, which can lead to memory corruption or process crashes. This vulnerability allows a local user with write access to the backing file to manipulate the bucket contents, potentially leading to unauthorized memory access. Organizations using affected versions should prioritize patching to mitigate risks associated with local exploitation.
Original NVD Description
Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb_contains_locked. The attach-time validator rb_validate_header checks the header scalars and region layout against the file size, but does not validate the bucket contents it then trusts. rb_contains_locked forms a container pointer as pool + container_off * 8192 from a raw file-stored offset and then searches over a file-stored cardinality, neither bounded against the container pool capacity or the fixed 8192-byte slot size. A local peer that can write the backing file can leave the header valid while poisoning a bucket, so the next membership query dereferences a file-controlled wild pointer and scans a file-controlled count, reading adjacent memory or crashing the process.