Description

picnixz

opened on Oct 27, 2024

Issue body actions

Crash report

What happened?

Similar to #126033, the following crashes:

import xml.etree.ElementTree as ET

class EvilTag(str):
    def __eq__(self, other):
        base.clear()
        return False

base = ET.Element('a')
base.append(ET.Element(EvilTag('x')))
base.find('a')

Attacked code:

cpython/Modules/_elementtree.c

Lines 1264 to 1275 in dc76a4a

	for (i = 0; i < self->extra->length; i++) {
	PyObject* item = self->extra->children[i];
	int rc;
	assert(Element_Check(st, item));
	Py_INCREF(item);
	rc = PyObject_RichCompareBool(((ElementObject*)item)->tag, path, Py_EQ);
	if (rc > 0)
	return item;
	Py_DECREF(item);
	if (rc < 0)
	return NULL;
	}

The findall and findtext methods also suffer from the same vulnerability. I haven't tried to attack Element.iterfind yet since it delegates to the Python function ElementPath.iterfind instead.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-126037: fix UAF in xml.etree.ElementTree.Element.find* when concurrent mutations happen #127964
• [3.13] gh-126037: fix UAF in xml.etree.ElementTree.Element.find* when current mutations happen (#127964) #131931
• [3.12] gh-126037: fix UAF in xml.etree.ElementTree.Element.find* when concurrent mutations happen (#127964) #131932

Activity

1. picnixz

   added

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   topic-XML

   type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   on Oct 27, 2024
2. picnixz

   self-assigned this

   on Oct 27, 2024
3. picnixz

   changed the title [-]Crash: `xml.etree.ElementTree.Element.find*` with an evil tag's `str.__eq__`[/-] [+]Crash: `xml.etree.ElementTree.Element.find*` when concurrent mutations happen[/+] on Dec 17, 2024
4. picnixz

   added a commit that references this issue on Mar 31, 2025

   gh-126037: fix UAF in `xml.etree.ElementTree.Element.find*` when conc…

   c57623c
5. picnixz

   changed the title [-]Crash: `xml.etree.ElementTree.Element.find*` when concurrent mutations happen[/-] [+]UAF: `xml.etree.ElementTree.Element.find*` when concurrent mutations happen[/+] on Mar 31, 2025
6. picnixz

   added 3 commits that reference this issue on Mar 31, 2025

   pythongh-126037: fix UAF in `xml.etree.ElementTree.Element.find*` whe…

   73fb894

   [3.12] gh-126037: fix UAF in `xml.etree.ElementTree.Element.find*` wh…

   f1689b6

   [3.13] gh-126037: fix UAF in `xml.etree.ElementTree.Element.find*` wh…

   588bb6d
7. picnixz

   closed this as completedon Mar 31, 2025

Issue actions