gh-125984: fix UAF on fut->fut_{callback,context}0 due to an evil loop.__getattribute__

[picnixz]

Minimal PoCs:

importasyncioclassEvilLoop: defcall_soon(self, *args, **kwargs): print(1) # crashes just after printingdefget_debug(self): returnFalsedef__getattribute__(self, name): globaltrackerifname=="call_soon": fut.remove_done_callback(tracker) deltrackerreturnobject.__getattribute__(self, name) fut=asyncio.Future(loop=EvilLoop()) tracker=lambda: ... fut.add_done_callback(tracker) fut.set_result("boom")

and

importasyncioclassEvilLoop: defcall_soon(self, *args, **kwargs): raiseException("unreachable") defget_debug(self): returnFalsedef__getattribute__(self, name): ifname=="call_soon": x=lambda: ... x.get_debug=lambda: Falsefut.__init__(loop=x) returnobject.__getattribute__(self, name) fut=asyncio.Future(loop=EvilLoop()) cb, ctx=lambda: ..., lambda: ... fut.add_done_callback(cb, context=ctx) delcb, ctxfut.set_result("kaboom")

Note that depending on how the PoC is written, the crash may happen at interpreter shutdown instead. The above PoCs are a bit different from the original ones and from the ones in the tests though, but I've confirmed that without the ownership transfer, all PoCs crash.

cc @Nico-Posada

• Issue: UAF on fut->fut_{callback,context}0 with evil __getattribute__ in _asynciomodule.c #125984

[miss-islington-app]

Thanks @picnixz for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

[bedevere-app]

GH-126043 is a backport of this pull request to the 3.13 branch.

[bedevere-app]

GH-126044 is a backport of this pull request to the 3.12 branch.