CVE-2025-40909

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-40909
Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226
https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e
https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch
https://github.com/Perl/perl5/issues/10387
https://github.com/Perl/perl5/issues/23010
https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads
https://www.openwall.com/lists/oss-security/2025/05/22/2
http://www.openwall.com/lists/oss-security/2025/05/23/1
http://www.openwall.com/lists/oss-security/2025/05/30/4
http://www.openwall.com/lists/oss-security/2025/06/02/2
http://www.openwall.com/lists/oss-security/2025/06/02/5
http://www.openwall.com/lists/oss-security/2025/06/02/6
http://www.openwall.com/lists/oss-security/2025/06/02/7
http://www.openwall.com/lists/oss-security/2025/06/03/1
Configurations

No configuration.

History

03 Jun 2025, 04:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/06/03/1 -

03 Jun 2025, 02:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/06/02/7 -

02 Jun 2025, 20:15

Type Values Removed Values Added
Summary
  • (es) Los subprocesos de Perl tienen una condición de ejecución en el directorio de trabajo donde las operaciones con archivos pueden dirigirse a rutas no deseadas. Si un identificador de directorio está abierto al crear el subproceso, el directorio de trabajo actual de todo el proceso se modifica temporalmente para clonar dicho identificador para el nuevo subproceso, visible desde cualquier tercer subproceso (o más) en ejecución. Esto puede provocar operaciones no deseadas, como la carga de código o el acceso a archivos desde ubicaciones inesperadas, que un atacante local podría explotar. El error se introdujo en el commit 11a11ecf4bea72b17d250cfb43c897be1341861e y se publicó en la versión 5.13.6 de Perl.
References
  • () http://www.openwall.com/lists/oss-security/2025/06/02/5 -
  • () http://www.openwall.com/lists/oss-security/2025/06/02/6 -

02 Jun 2025, 11:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/06/02/2 -

31 May 2025, 01:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/05/30/4 -

30 May 2025, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.9

30 May 2025, 14:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/05/23/1 -

30 May 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-30 13:15

Updated : 2025-06-03 04:15

NVD link : CVE-2025-40909

Mitre link : CVE-2025-40909

CVE.ORG link : CVE-2025-40909

JSON object : View

Products Affected

No product.

CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-426

Untrusted Search Path