PSF-2018-2

See a problem?
Import Source
https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2018-2.json
JSON Data
https://api.test.osv.dev/v1/vulns/PSF-2018-2
Aliases
Published
2018-02-08T17:00:00Z
Modified
2023-11-01T04:48:31.827825Z
Summary
Python 2.7 readahead is not thread safe
Details

Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.

Database specific
{
    "cwe_ids": []
}
References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type
GIT
Repo
https://github.com/python/cpython
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Database specific

{
    "vanir_signatures": [
        {
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "323543115282939855335627781104736550655",
                    "123742463445805796580442705404907079679",
                    "202816757465683637633440828692147533962",
                    "184643843703879312431626236860159007576",
                    "261907143414595581068627280275627726470",
                    "158700292985958317076457455599972852186",
                    "11133040543889074775166701287322774622",
                    "206196018956521294341621139107162734223",
                    "258008840679493368401860072185665047648",
                    "158912025914019037714530482644188295955",
                    "118397333679176662679091911608283280188",
                    "318013449774955445047936724426302612012",
                    "34711568872535288210473113961271772291",
                    "89674761934528476661792634480810536635",
                    "154175948685301511741557774476058693276",
                    "145652323950257575435848658785551004139",
                    "212543404993786952114018856636444145431",
                    "217083153076009549754542300420306477956",
                    "197635936743591306388077955471938603702",
                    "65022073363405100203006500825656534340",
                    "53432988100559648104096544295690405213",
                    "243373762099040107108891551979862480211",
                    "63639112030521365300530531963098350874",
                    "203687335748945943425494444525578288633",
                    "222131502876036855138909508916569830606",
                    "183244489349433250317300329819015508150",
                    "245482094097972397741807538647600197968",
                    "312281367845805122394661907061627293128",
                    "150428200689309013823259672032444523773",
                    "211008218391529950244962955577572821320",
                    "129231508069497860068283493283289769855",
                    "10094250209465030514615393933702668490",
                    "316863664070254806091059426194378674286",
                    "305590346159099807840926463596945009626",
                    "137598507701532014680792927862689023184",
                    "145649260287876754307474821958793959220",
                    "246501656905204529807944861841466505739",
                    "168494494702021012242274088564870605507",
                    "149588156586333106944220519325715280458",
                    "174725052039379418586093953717432796015",
                    "332088892115627133206442641735201519116",
                    "24605427968584248231893514233706837412",
                    "258571740082102543567799992098616276079",
                    "45179289304203293450353186804558685104",
                    "321015503989240293823231790891645317716",
                    "240273111711418215926025779201651690129",
                    "102378847949843245644659363483076310391",
                    "120170274130484966960105921875177474071",
                    "230016349326511101168610878373103130569",
                    "325348214856800574555563561018366024963",
                    "166158519228148420028334152815754853466",
                    "283562493685890587498305939065731730611",
                    "339868224326905846025620499701299696557",
                    "253982512549272344924364363125182640073",
                    "224570718897906043207980857067022280654",
                    "27786715777652055291299461120899458362",
                    "280347238258784997624107472354938325338",
                    "302550940502737299727203062530843105946",
                    "74740079308833782841998915332235042275",
                    "158358004514052623079963909820203384266",
                    "321697133738963991706883411839552487767",
                    "122720314619016432383330180496779367171",
                    "239597304100106612533491931386554367373",
                    "71553562197047645737388942357165412167",
                    "37741137503595965615791996165228671499",
                    "253020882204845010202172065873179527896",
                    "298220692976263406276238790250307973959",
                    "193898440642750129825097718009360847281",
                    "205198062765309416356206791379613898039",
                    "248115737368821907468899809286965778151",
                    "1773655962654771942491362996627829893",
                    "253588061639358237052883682316258075062",
                    "304454315367309429290412910443141639315",
                    "60754734568097475390652323990511141177",
                    "170237677888839855456502562858110890933",
                    "45011136378799885890402838565626095351",
                    "13689286819447029559221521317312400642",
                    "243593717938737988808566047149163716809",
                    "110720415229777877389404705042964497853",
                    "279887957875546660686113687429570201132",
                    "160788811190649795991226949347507962610",
                    "274927131745526808311115407037500339584",
                    "49196842707442615675453290699589347419",
                    "27200494530742855321317319757951236879",
                    "217637357010082137005043068841442211146",
                    "332083121281462843179339614116592700301",
                    "57971750784471721151396787928521357782",
                    "166495590613952545852154182416606198275",
                    "210428338606929506835056621613315853965",
                    "165809872704106561889223141891731077923",
                    "212058077957985126061056422146858411245",
                    "219559302974481898678714551150824969860",
                    "168968943076640108634641492971215640602",
                    "64455170317011002261501593532365994918",
                    "176035767951174638308991985415517261324",
                    "243901256298969333007463169275905300752",
                    "279148721690009403826045118746750536929",
                    "93669838124201675629879004157213044082",
                    "149940277223128915758291431555855257384",
                    "280171645607347755321596846935917753772",
                    "292138990023438447969892331803919594191",
                    "5932922897700951124494516515979100348",
                    "114826440092178776407085257671512649625",
                    "313685864265228648164704047395004926252",
                    "53758617776720036208126214344712774541",
                    "317317971753040403069503834397883122006",
                    "221855449822216919995962101159512537334",
                    "32088705879463732391842111460683338929",
                    "313659881200708513576514287366489280759"
                ],
                "threshold": 0.9
            },
            "source": "https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b",
            "signature_type": "Line",
            "id": "PSF-2018-2-530d6be7",
            "target": {
                "file": "Objects/fileobject.c"
            },
            "signature_version": "v1"
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "269485302226630615120407486640244123781",
                "length": 1169.0
            },
            "source": "https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b",
            "signature_type": "Function",
            "id": "PSF-2018-2-56ff38a3",
            "target": {
                "function": "file_seek",
                "file": "Objects/fileobject.c"
            },
            "signature_version": "v1"
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "46426356841523651039271937818992643129",
                "length": 1176.0
            },
            "source": "https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b",
            "signature_type": "Function",
            "id": "PSF-2018-2-5e512db6",
            "target": {
                "function": "readahead_get_line_skip",
                "file": "Objects/fileobject.c"
            },
            "signature_version": "v1"
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "172007661186988687030094743099575326409",
                "length": 326.0
            },
            "source": "https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b",
            "signature_type": "Function",
            "id": "PSF-2018-2-6ad7e29a",
            "target": {
                "function": "file_iternext",
                "file": "Objects/fileobject.c"
            },
            "signature_version": "v1"
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "215014135469086011398598779954149897954",
                "length": 738.0
            },
            "source": "https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b",
            "signature_type": "Function",
            "id": "PSF-2018-2-aa66de54",
            "target": {
                "function": "readahead",
                "file": "Objects/fileobject.c"
            },
            "signature_version": "v1"
        },
        {
            "deprecated": false,
            "digest": {
                "function_hash": "45923269405873619774525886874692278713",
                "length": 131.0
            },
            "source": "https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b",
            "signature_type": "Function",
            "id": "PSF-2018-2-c2f9ea64",
            "target": {
                "function": "drop_readahead",
                "file": "Objects/fileobject.c"
            },
            "signature_version": "v1"
        }
    ]
}