CVE-2025-40909

Published: May 30, 2025Modified: Jun 17, 2026Deferred

5.9

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.5 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

Related CWEs

Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Permission Race Condition During Resource Copy

The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place.

References (18)

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://github.com/Perl/perl5/issues/10387

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://github.com/Perl/perl5/issues/23010

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://www.openwall.com/lists/oss-security/2025/05/22/2

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

http://seclists.org/fulldisclosure/2025/Sep/53

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2025/Sep/54

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2025/Sep/55

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/05/23/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/05/30/4

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/06/02/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/06/02/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/06/02/6

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/06/02/7

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2025/06/03/1

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.