CVE-2025-40909: Perl threads have a working directory race condition where file operations may target unintended paths

[Stig Palmquist <stig () stig io>]

========================================================================
CVE-2025-40909                                       CPAN Security Group
========================================================================

        CVE ID:  CVE-2025-40909
  Distribution:  perl
      Versions:  from 5.13.6 before 5.41.13

      MetaCPAN:  https://metacpan.org/dist/perl
      VCS Repo:  https://github.com/perl/perl5


Perl threads have a working directory race condition where file
operations may target unintended paths

Description
-----------
Perl threads have a working directory race condition where file
operations may target unintended paths.

If a directory handle is open at thread creation, the process-wide
current working directory is temporarily changed in order to clone that
handle for the new thread, which is visible from any third (or more)
thread already running. 

This may lead to unintended operations such as loading code or
accessing files from unexpected locations, which a local attacker may
be able to exploit.

The bug was introduced in commit
11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version
5.13.6

Problem types
-------------
CWE-362 Concurrent Execution using Shared Resource with Improper
Synchronization ('Race Condition')
CWE-426 Untrusted Search Path

Solutions
---------
Update perl to an unaffected version, or apply the patch provided in
the references section.


References
----------
https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch
https://www.openwall.com/lists/oss-security/2025/05/22/2
https://github.com/Perl/perl5/issues/23010
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226
https://github.com/Perl/perl5/issues/10387
https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads
https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e

Credits
-------
Vincent Lefevre, finder