GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||||||||||||||||
GeezerVison is showing github.com — UAF: `xml.etree.ElementTree.Element.remove` when concurrent mutations happen · Issue #126033 · python/cpython Closed Assignees Labels 3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtopic-XMLtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump DescriptionCrash reportWhat happened?A UAF in import xml.etree.ElementTree as ET class EvilElement(ET.Element): def __eq__(self, other): base.clear() return False base = ET.Element('a') base.append(EvilElement('a')) base.append(EvilElement('a')) base.remove(ET.Element('b')) Attacked code: cpython/Modules/_elementtree.c Lines 1648 to 1656 in dc76a4a
I think we need to introduce some state integer to check that there is no evil mutation (similar to what's being done for CPython versions tested on:CPython main branch Operating systems tested on:No response Output from running 'python -VV' on the command line:No response Linked PRs
Activity
MetadataMetadataAssigneesLabels3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirtopic-XMLtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump ProjectsMilestoneRelationshipsDevelopmentIssue actions | ||||||||||||||||||
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |