-
-
Notifications
You must be signed in to change notification settings - Fork 32.6k
Closed
Labels
3.12only security fixesonly security fixes3.13bugs and security fixesbugs and security fixes3.14bugs and security fixesbugs and security fixestopic-asynciotype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
Description
Crash report
Bug description:
This is an issue just to track the progress of fixing the UAF on fut->fut_callback0
(see #125833 (comment)).
The UAF that could be exploited by clearing fut._callbacks
won't be triggered anymore since after #125922, we will not mutate the internal list itself anymore but it is still be possilbe to mutate fut->fut_callback0
directly: #125833 (comment).
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Linked PRs
- gh-125966: fix UAF on
fut->fut_callback0
due to an evil callback's__eq__
#125967 - [3.13] gh-125966: fix use-after-free on
fut->fut_callback0
due to an evil callback's__eq__
in asyncio (GH-125967) #126047 - [3.12] gh-125966: fix use-after-free on
fut->fut_callback0
due to an evil callback's__eq__
in asyncio (GH-125967) #126048
Metadata
Metadata
Assignees
Labels
3.12only security fixesonly security fixes3.13bugs and security fixesbugs and security fixes3.14bugs and security fixesbugs and security fixestopic-asynciotype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
Projects
Status
Done