oss-security - CVE-2025-40909: Perl threads have a working directory race condition where file operations may target unintended paths

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <omnnpezilawlern5txh6xnng26fmenimxl7ijy6oykuxlurfbg@yo2pvsq3q6v6>
Date: Fri, 30 May 2025 14:29:29 +0200
From: Stig Palmquist <stig@...g.io>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-40909: Perl threads have a working directory race condition
 where file operations may target unintended paths

========================================================================
CVE-2025-40909                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2025-40909
  Distribution:  perl
      Versions:  from 5.13.6 before 5.41.13

      MetaCPAN:  https://metacpan.org/dist/perl
      VCS Repo:  https://github.com/perl/perl5


Perl threads have a working directory race condition where file
operations may target unintended paths

Description
-----------
Perl threads have a working directory race condition where file
operations may target unintended paths.

If a directory handle is open at thread creation, the process-wide
current working directory is temporarily changed in order to clone that
handle for the new thread, which is visible from any third (or more)
thread already running. 

This may lead to unintended operations such as loading code or
accessing files from unexpected locations, which a local attacker may
be able to exploit.

The bug was introduced in commit
11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version
5.13.6

Problem types
-------------
CWE-362 Concurrent Execution using Shared Resource with Improper
Synchronization ('Race Condition')
CWE-426 Untrusted Search Path

Solutions
---------
Update perl to an unaffected version, or apply the patch provided in
the references section.


References
----------
https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch
https://www.openwall.com/lists/oss-security/2025/05/22/2
https://github.com/Perl/perl5/issues/23010
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226
https://github.com/Perl/perl5/issues/10387
https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads
https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e

Credits
-------
Vincent Lefevre, finder

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.