GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — `_SelectorSocketTransport.writelines` is missing a flow control check allowing writes to fill memory until exhausted · Issue #127655 · python/cpython

_SelectorSocketTransport.writelines is missing a flow control check allowing writes to fill memory until exhausted #127655

New issue
Copy link
New issue
Copy link
Closed
Closed
_SelectorSocketTransport.writelines is missing a flow control check allowing writes to fill memory until exhausted#127655
Copy link
Labels
3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytopic-asynciotype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-securityA security issueA security issue

Description

@bdraco
bdraco
opened on Dec 5, 2024
Issue body actions

Bug report

Bug description:

This is the public issue for GHSA-fw89-6wjj-8j95

CPython versions tested on:

3.12

Operating systems tested on:

Linux, macOS

Linked PRs

  • gh-127655: Ensure _SelectorSocketTransport.writelines pauses the protocol if needed #127656
  • [3.13] gh-127655: Ensure _SelectorSocketTransport.writelines pauses the protocol if needed (GH-127656) #127663
  • [3.12] gh-127655: Ensure _SelectorSocketTransport.writelines pauses the protocol if needed (GH-127656) #127664

Activity

Next
  1. bdraco
    added
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Dec 5, 2024
  2. picnixz
    added
    type-securityA security issueA security issue
    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory
    3.11only security fixesonly security fixes
    3.10 (EOL)end of lifeend of life
    3.9 (EOL)end of lifeend of life
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    topic-asyncio
    on Dec 6, 2024
  3. github-project-automation
    added this to asyncioon Dec 6, 2024
  4. github-project-automation
    moved this to Todo in asyncioon Dec 6, 2024

  5. picnixz commented on Dec 6, 2024

    @picnixz
    picnixz
    on Dec 6, 2024
    Member
    More actions

    @bdraco I put all security labels but does it affect 3.9/3.10/3.11? (can't check for now)

  6. bdraco commented on Dec 6, 2024

    @bdraco
    bdraco
    on Dec 6, 2024
    ContributorAuthor
    More actions

    Its 3.12+ only since writelines was implemented in asyncio selector transport in 3.12

    Reacted by Bénédikt Tran
  7. picnixz
    removed
    3.11only security fixesonly security fixes
    on Dec 6, 2024

  8. 5 remaining items

  9. kumaraditya303 commented on Dec 6, 2024

    @kumaraditya303
    kumaraditya303
    on Dec 6, 2024
    Contributor
    More actions

    Thanks @bdraco

    I assume aiohttp would be affected by this too if it uses writelines. If possible do share any performance numbers you have of how much impact the zero copy writes have made to aiohttp.

  10. bdraco commented on Dec 6, 2024

    @bdraco
    bdraco
    on Dec 6, 2024
    ContributorAuthor
    More actions

    Thanks @bdraco

    I assume aiohttp would be affected by this too if it uses writelines. If possible do share any performance numbers you have of how much impact the zero copy writes have made to aiohttp.

    @kumaraditya303

    aio-libs/aiohttp#10126 is the PR from a few hours ago that turned off zero copy writes which was released as part of aiohttp 3.11.10

    The codspeed report shows the degraded performances however its not so great because we were pushing the CI pretty hard at the time and it wasn't keeping up. codspeed is set to only show changes >8% on GH so you'd have to look at the report directly to get a better idea.

    This run https://codspeed.io/aio-libs/aiohttp/runs/675241d947498039ef29339c is probably the best one to look at for aiohttp 3.11.x. For aiohttp master branch https://codspeed.io/aio-libs/aiohttp/branches/disable_zero_copy as its going to show the difference the memcpy makes.

    The relevant benchmarks that show a real difference are (keep in mind we are benchmarking disabling zero copy writes):

    test_one_hundred_get_requests_with_1024_chunked_payload +3% (writelines is a bit worse for tiny payloads)
    test_one_hundred_get_requests_with_512kib_chunked_payload -21% (writelines is a lot better for large payloads)
    test_one_hundred_get_requests_with_30000_chunked_payload -4% (writelines is a slightly better for medium size payloads)

    Note that the margin of error is ~1-3% with the benchmarking (but if you have experience and a bit of wetware memory of previous runs, you can look at the flame-graphs you can usually tell if its error or actual change). Based on that, I'd say the above seems accurate and the error rate here is likely <1% between runs.

    Also benchmarks above were run with 3.12. We switched to benchmarking with 3.13 now that the first patch release, 3.13.1 is out a few hours after these runs. https://codspeed.io/aio-libs/aiohttp/runs/67524ceb47498039ef2933c9 is the first run with Python 3.13 for aiohttp 3.11 and shows a few unrelated (to this issue) improvements. More details in aio-libs/aiohttp#10131

    Reacted by Kumar Aditya
  11. kumaraditya303
    added 2 commits that reference this issue on Dec 6, 2024

    [3.13] gh-127655: Ensure `_SelectorSocketTransport.writelines` pauses…

    71e8429

    [3.12] gh-127655: Ensure `_SelectorSocketTransport.writelines` pauses…

    9aa0deb

  12. bdraco commented on Dec 6, 2024

    @bdraco
    bdraco
    on Dec 6, 2024
    ContributorAuthor
    More actions

    Closing issue as linked PRs are merged

  13. bdraco
    closed this as completedon Dec 6, 2024
  14. github-project-automation
    moved this from Todo to Done in asyncioon Dec 6, 2024
  15. stratakis
    added a commit that references this issue on Dec 6, 2024

    00445: CVE-2024-12254: Ensure _SelectorSocketTransport.writelines pau…

    63eef28
  16. algitbot
    added 3 commits that reference this issue on Dec 7, 2024

    main/python3: patch CVE-2024-12254

    717301b

    main/python3: patch CVE-2024-12254

    75e920e

    main/python3: patch CVE-2024-12254

    94afa02
  17. hroncok
    added a commit that references this issue on Dec 9, 2024

    00445: CVE-2024-12254: Ensure _SelectorSocketTransport.writelines pau…

    3be48a3
  18. bell-sw
    added a commit that references this issue on Dec 9, 2024

    core/python3: patch CVE-2024-12254

    913761c
  19. stratakis
    added a commit that references this issue on Dec 9, 2024

    00445: CVE-2024-12254: Ensure _SelectorSocketTransport.writelines pau…

    1a45383
  20. srinivasreddy
    added a commit that references this issue on Jan 8, 2025

    pythongh-127655: Ensure `_SelectorSocketTransport.writelines` pauses …

    9294932
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytopic-asynciotype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-securityA security issueA security issue

    Projects

    • asyncio
      Status
      Done
      Show more project fields

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions
    You are visitor 01402520 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.