GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-97514: Don't use Linux abstract sockets for multiprocessing by gpshead · Pull Request #98501 · python/cpython

Conversation

@gpshead

@gpshead gpshead commented Oct 20, 2022 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Linux abstract sockets lack any form of permissions so their use allows any process in the same host-local network namespace (which means any user on the system in many default configurations) to inject code into the process. A "same machine Remote Code Execution RCE" vulnerability.

This removes the default preference for abstract sockets in multiprocessing introduced in Python 3.9+ via
#18866 while fixing #84031.

This issue was reported to the PSRT on 2022-09-07 by Devin Jeanpierre @ssbr from Google. @gpshead requested the CVE.

More good reasoning on why to avoid abstract AF_UNIX sockets on Linux: https://web.archive.org/web/20220107100548/https://utcc.utoronto.ca/~cks/space/blog/linux/SocketAbstractNamespace?showcomments#comments

This is intended for backporting to apply to 3.9 - 3.12.


Urgency: The Release Manager @pablogsal has approved having this in 3.11.0. As the issue is Linux only, there is NO urgent need for new Windows or macOS package builds. So even if a new 3.10.x and 3.9.x release is not officially cut while making it public, this small change is trivially back-ported by all involved Linux Python binary package distributors whom we assume will be very interested in having it.


PSRT report & discussion: https://mail.python.org/archives/list/[email protected]/thread/WMFW2T2I4P3I7SQHYJEBZTSHRVJT44F6/

  • Issue: Linux specific local privilege escalation via the multiprocessing forkserver start method - CVE-2022-42919 #97514

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
gpshead and others added 5 commits October 13, 2022 23:39
@gpshead
pythongh-97514: Don't use Linux abstract sockets for multiprocessing.
6465b53
Linux abstract sockets are insecure as they lack any form of filesystem
permissions so their use allows anyone on the system to inject code into
the process.

This removes the default preference for abstract sockets in
multiprocessing introduced in Python 3.9+ via
python#18866 while fixing
python#84031.

Explicit use of an abstract socket by a user now generates a
RuntimeWarning.  If we choose to keep this warning, it should be
backported to the 3.7 and 3.8 branches.
@gpshead
Remove the warning.
de8571d
The right people won't see it and it won't blame the right code.
@gpshead
Reword NEWS, refer to CVE-2022-42919.
8c50714
@gpshead
NEWS wording tweaks
4c3ce41
@gpshead
Reword the NEWS entry again.
4f1b535
@gpshead gpshead added type-bug An unexpected behavior, bug, or error type-security A security issue needs backport to 3.9 release-blocker needs backport to 3.11 only security fixes labels Oct 20, 2022
@gpshead
gpshead requested a review from pablogsal October 20, 2022 21:58
@gpshead gpshead self-assigned this Oct 20, 2022
@bedevere-bot bedevere-bot added the awaiting core review label Oct 20, 2022
@gpshead
gpshead marked this pull request as ready for review October 20, 2022 21:59
@gpshead
gpshead requested a review from Yhg1s October 20, 2022 22:21
Yhg1s
Yhg1s approved these changes Oct 20, 2022
View reviewed changes
@bedevere-bot bedevere-bot added awaiting merge and removed awaiting core review labels Oct 20, 2022
@Yhg1s
Yhg1s merged commit 49f6106 into python:main Oct 20, 2022
@miss-islington

miss-islington commented Oct 20, 2022

Copy link
Copy Markdown
Contributor

Thanks @gpshead for the PR, and @Yhg1s for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-bot bedevere-bot removed the awaiting merge label Oct 20, 2022
@bedevere-bot

bedevere-bot commented Oct 20, 2022

Copy link
Copy Markdown

GH-98502 is a backport of this pull request to the 3.11 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 20, 2022
@gpshead @miss-islington
pythongh-97514: Don't use Linux abstract sockets for multiprocessing (p…
bf61665
…ythonGH-98501)

Linux abstract sockets are insecure as they lack any form of filesystem
permissions so their use allows anyone on the system to inject code into
the process.

This removes the default preference for abstract sockets in
multiprocessing introduced in Python 3.9+ via
python#18866 while fixing
python#84031.

Explicit use of an abstract socket by a user now generates a
RuntimeWarning.  If we choose to keep this warning, it should be
backported to the 3.7 and 3.8 branches.
(cherry picked from commit 49f6106)

Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-bot bedevere-bot removed the needs backport to 3.11 only security fixes label Oct 20, 2022
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 20, 2022
@gpshead @miss-islington
pythongh-97514: Don't use Linux abstract sockets for multiprocessing (p…
e745de3
…ythonGH-98501)

Linux abstract sockets are insecure as they lack any form of filesystem
permissions so their use allows anyone on the system to inject code into
the process.

This removes the default preference for abstract sockets in
multiprocessing introduced in Python 3.9+ via
python#18866 while fixing
python#84031.

Explicit use of an abstract socket by a user now generates a
RuntimeWarning.  If we choose to keep this warning, it should be
backported to the 3.7 and 3.8 branches.
(cherry picked from commit 49f6106)

Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-bot

bedevere-bot commented Oct 20, 2022

Copy link
Copy Markdown

GH-98503 is a backport of this pull request to the 3.10 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-bot bedevere-bot removed the needs backport to 3.10 label Oct 20, 2022
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 20, 2022
@gpshead @miss-islington
pythongh-97514: Don't use Linux abstract sockets for multiprocessing (p…
32b2d32
…ythonGH-98501)

Linux abstract sockets are insecure as they lack any form of filesystem
permissions so their use allows anyone on the system to inject code into
the process.

This removes the default preference for abstract sockets in
multiprocessing introduced in Python 3.9+ via
python#18866 while fixing
python#84031.

Explicit use of an abstract socket by a user now generates a
RuntimeWarning.  If we choose to keep this warning, it should be
backported to the 3.7 and 3.8 branches.
(cherry picked from commit 49f6106)

Co-authored-by: Gregory P. Smith <[email protected]>
@gpshead
gpshead deleted the multiprocessing-abstract branch October 20, 2022 23:11
@gpshead gpshead added needs backport to 3.9 and removed needs backport to 3.9 labels Oct 20, 2022
@miss-islington

miss-islington commented Oct 20, 2022

Copy link
Copy Markdown
Contributor

Thanks @gpshead for the PR, and @Yhg1s for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 20, 2022
@gpshead @miss-islington
pythongh-97514: Don't use Linux abstract sockets for multiprocessing (p…
85178d5
…ythonGH-98501)

Linux abstract sockets are insecure as they lack any form of filesystem
permissions so their use allows anyone on the system to inject code into
the process.

This removes the default preference for abstract sockets in
multiprocessing introduced in Python 3.9+ via
python#18866 while fixing
python#84031.

Explicit use of an abstract socket by a user now generates a
RuntimeWarning.  If we choose to keep this warning, it should be
backported to the 3.7 and 3.8 branches.
(cherry picked from commit 49f6106)

Co-authored-by: Gregory P. Smith <[email protected]>
@gpshead

gpshead commented Oct 20, 2022

Copy link
Copy Markdown
Member Author

GH-98504 is the backport of this pull request to the 3.9 branch. (miss-islington created the PR but some how fell over applying labels to it and posting this message here)

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington added a commit that referenced this pull request Oct 20, 2022
@miss-islington
[3.10] gh-97514: Don't use Linux abstract sockets for multiprocessing (…
eae692e
…GH-98501) (GH-98503)

Linux abstract sockets are insecure as they lack any form of filesystem
permissions so their use allows anyone on the system to inject code into
the process.

This removes the default preference for abstract sockets in
multiprocessing introduced in Python 3.9+ via
#18866 while fixing
#84031.

Explicit use of an abstract socket by a user now generates a
RuntimeWarning.  If we choose to keep this warning, it should be
backported to the 3.7 and 3.8 branches.
(cherry picked from commit 49f6106)


Co-authored-by: Gregory P. Smith <[email protected]>

Automerge-Triggered-By: GH:gpshead
miss-islington added a commit that referenced this pull request Oct 20, 2022
@miss-islington
[3.11] gh-97514: Don't use Linux abstract sockets for multiprocessing (…
4686d77
…GH-98501) (GH-98502)

Linux abstract sockets are insecure as they lack any form of filesystem
permissions so their use allows anyone on the system to inject code into
the process.

This removes the default preference for abstract sockets in
multiprocessing introduced in Python 3.9+ via
#18866 while fixing
#84031.

Explicit use of an abstract socket by a user now generates a
RuntimeWarning.  If we choose to keep this warning, it should be
backported to the 3.7 and 3.8 branches.
(cherry picked from commit 49f6106)


Co-authored-by: Gregory P. Smith <[email protected]>

Automerge-Triggered-By: GH:gpshead
pablogsal pushed a commit that referenced this pull request Oct 22, 2022
@miss-islington @pablogsal
[3.11] gh-97514: Don't use Linux abstract sockets for multiprocessing (…
4c0c1e2
…GH-98501) (GH-98502)

Linux abstract sockets are insecure as they lack any form of filesystem
permissions so their use allows anyone on the system to inject code into
the process.

This removes the default preference for abstract sockets in
multiprocessing introduced in Python 3.9+ via
#18866 while fixing
#84031.

Explicit use of an abstract socket by a user now generates a
RuntimeWarning.  If we choose to keep this warning, it should be
backported to the 3.7 and 3.8 branches.
(cherry picked from commit 49f6106)


Co-authored-by: Gregory P. Smith <[email protected]>

Automerge-Triggered-By: GH:gpshead
ambv pushed a commit that referenced this pull request Oct 28, 2022
@miss-islington @gpshead
[3.9] gh-97514: Don't use Linux abstract sockets for multiprocessing (G…
b43496c
…H-98501) (#98504)

Linux abstract sockets are insecure as they lack any form of filesystem
permissions so their use allows anyone on the system to inject code into
the process.

This removes the default preference for abstract sockets in
multiprocessing introduced in Python 3.9+ via
#18866 while fixing
#84031.

Explicit use of an abstract socket by a user now generates a
RuntimeWarning.  If we choose to keep this warning, it should be
backported to the 3.7 and 3.8 branches.
(cherry picked from commit 49f6106)

Co-authored-by: Gregory P. Smith <[email protected]>
@gpshead gpshead removed the needs backport to 3.9 label Nov 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Yhg1s Yhg1s Yhg1s approved these changes
@pablogsal pablogsal Awaiting requested review from pablogsal

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

release-blocker type-bug An unexpected behavior, bug, or error type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@gpshead @miss-islington @bedevere-bot @Yhg1s
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.