CyberRota Analysis
AI-GeneratedVersions of Data::RingBuffer::Shared for Perl prior to 0.04 are vulnerable to a stack buffer overflow due to an unvalidated elem_size parameter in the ring_read_seq function. This vulnerability allows a local attacker with write access to the backing file to manipulate the elem_size, potentially leading to arbitrary code execution or data corruption by overwriting adjacent stack frames. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq. The attach-time validator ring_validate_header checks the capacity-overflow and total_size consistency of the header but never caps elem_size against the destination size. ring_read_seq does memcpy(out, ring_slot(h, seq), elem_size) with elem_size read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elem_size larger than 8 bytes writes past the destination. A local peer that can write the backing file can leave the header valid while setting a large elem_size, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.