Skip to content

gh-125969: fix OOB in future_schedule_callbacks due to an evil call_soon#125970

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
kumaraditya303 merged 8 commits into from
Oct 25, 2024
Merged

gh-125969: fix OOB in future_schedule_callbacks due to an evil call_soon#125970

kumaraditya303 merged 8 commits into from
Oct 25, 2024

Conversation

@picnixz
Copy link
Member

@picnixzpicnixz commented Oct 25, 2024•
edited by bedevere-app bot
Loading

@bedevere-appbedevere-appbot mentioned this pull request Oct 25, 2024
Closed
@picnixzpicnixz added needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes labels Oct 25, 2024
graingert
graingert reviewed Oct 25, 2024
View reviewed changes
@picnixzpicnixz mentioned this pull request Oct 25, 2024
Closed
asvetlov
asvetlov requested changes Oct 25, 2024
View reviewed changes
Copy link
Contributor

@asvetlovasvetlov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch!

Please address notes.

@bedevere-app
Copy link

bedevere-appbot commented Oct 25, 2024

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@asvetlovasvetlov self-assigned this Oct 25, 2024
@picnixz
Copy link
MemberAuthor

picnixz commented Oct 25, 2024

I have made the requested changes; please review again.

@bedevere-app
Copy link

bedevere-appbot commented Oct 25, 2024

Thanks for making the requested changes!

@asvetlov: please review the changes made to this pull request.

@bedevere-appbedevere-appbot requested a review from asvetlovOctober 25, 2024 12:33
@asvetlov
Copy link
Contributor

asvetlov commented Oct 25, 2024

LGTM!

kumaraditya303
kumaraditya303 reviewed Oct 25, 2024
View reviewed changes
@Nico-Posada
Copy link
Contributor

Nico-Posada commented Oct 25, 2024

This might need a new issue opened, but you can still UAF on callback0 using a malicious getattribute in the loop obj

importasyncioclassEvilLoop: defcall_soon(*args): # will crash before it actually gets here print(args) defget_debug(self): returnFalsedef__getattribute__(self, name): globaltrackerifname=="call_soon": fut.remove_done_callback(tracker) deltrackerprint("returning get_soon fn after clearing callback0") returnobject.__getattribute__(self, name) classTrackDel: def__del__(self): print("deleted", self) fut=asyncio.Future(loop=EvilLoop()) tracker=TrackDel() fut.add_done_callback(tracker) fut.set_result("kaboom")

@picnixz
Copy link
MemberAuthor

picnixz commented Oct 25, 2024•
edited
Loading

This might need a new issue opened, but you can still UAF on callback0 using a malicious getattribute in the loop obj

Let's have another issue for this one. I only noticed the OOB issue when splitting the PR.

See: #125984.

@picnixzpicnixz mentioned this pull request Oct 25, 2024
Closed
@willingc
Copy link
Contributor

willingc commented Oct 25, 2024

Thanks @asvetlov for the review. I hope all is going well with you.

@asvetlov
Copy link
Contributor

asvetlov commented Oct 25, 2024

Thank you, @willingc, I'm good.
Yeah, last years were hard to me.

@kumaraditya303
Copy link
Contributor

kumaraditya303 commented Oct 25, 2024

Good to see you back @asvetlov

@kumaraditya303kumaraditya303 merged commit c5b99f5 into python:mainOct 25, 2024
@miss-islington-app
Copy link

miss-islington-appbot commented Oct 25, 2024

Thanks @picnixz for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 25, 2024
@picnixz@asvetlov@miss-islington
pythongh-125969: fix OOB infuture_schedule_callbacksdue to an evi…
0b7fad3
…l `call_soon` (pythonGH-125970) (cherry picked from commit c5b99f5) Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 25, 2024
@picnixz@asvetlov@miss-islington
pythongh-125969: fix OOB infuture_schedule_callbacksdue to an evi…
4a95a26
…l `call_soon` (pythonGH-125970) (cherry picked from commit c5b99f5) Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
@bedevere-app
Copy link

bedevere-appbot commented Oct 25, 2024

GH-125991 is a backport of this pull request to the 3.13 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.13 bugs and security fixes label Oct 25, 2024
@bedevere-app
Copy link

bedevere-appbot commented Oct 25, 2024

GH-125992 is a backport of this pull request to the 3.12 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.12 only security fixes label Oct 25, 2024
@picnixzpicnixz deleted the fix/future-segfault-125969 branch October 25, 2024 18:20
kumaraditya303 pushed a commit that referenced this pull request Oct 25, 2024
@miss-islington@picnixz@asvetlov
[3.12]gh-125969: fix OOB infuture_schedule_callbacksdue to an ev…
f6682fb
…il `call_soon` (GH-125970) (#125992) gh-125969: fix OOB in `future_schedule_callbacks` due to an evil `call_soon` (GH-125970) (cherry picked from commit c5b99f5) Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
kumaraditya303 pushed a commit that referenced this pull request Oct 25, 2024
@miss-islington@picnixz@asvetlov
[3.13]gh-125969: fix OOB infuture_schedule_callbacksdue to an ev…
9c6cda5
…il `call_soon` (GH-125970) (#125991) gh-125969: fix OOB in `future_schedule_callbacks` due to an evil `call_soon` (GH-125970) (cherry picked from commit c5b99f5) Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
@asvetlov
Copy link
Contributor

asvetlov commented Oct 25, 2024

thanks, @kumaraditya303

ebonnal pushed a commit to ebonnal/cpython that referenced this pull request Jan 12, 2025
@picnixz@asvetlov@ebonnal
pythongh-125969: fix OOB infuture_schedule_callbacksdue to an evi…
44bf6d6
…l `call_soon` (python#125970) Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@graingertgraingertgraingert left review comments

@asvetlovasvetlovasvetlov approved these changes

@kumaraditya303kumaraditya303kumaraditya303 approved these changes

@1st11st1Awaiting requested review from 1st11st1 is a code owner

@gvanrossumgvanrossumAwaiting requested review from gvanrossum

@willingcwillingcAwaiting requested review from willingcwillingc is a code owner

Assignees

@asvetlovasvetlov

Labels

topic-asyncio

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@picnixz@asvetlov@Nico-Posada@willingc@kumaraditya303@graingert