31–40 of 72 posts
This inspired me to grep the cpython code for sprintf. I found one used with the return value from alloca (inside FindAddress in _ctypes.c). It checks alloca for NULL (does alloca ever return NULL?), but I could imagine it might expoitable. FindAddress is a static function that can be called during DLL loading. I imagine that there is very little code that accepts untrusted arguments to DLL loading though (if so, the…
Remediation for this vulnerability basically caused complete gridlock for the internal tools at a certain FAANG company today.
Remediation for this vulnerability basically caused complete gridlock for the internal tools at a certain FAANG company today.
The "elite" engineers are using ctypes in production? ctypes has never been considered even remotely secure, it can call any library function, including, drumroll, sprintf!
Earlier quoted context omitted.
Distros are backporting security patches into their releases, so no harm done. If you rely on the python.org releases and don't build from source, then yes, that is a bit sad. Case in point: The Debian security tracker, see their notes section referencing each commit. https://security-tracker.debian.org/tracker/CVE-2021-3177
The python:3.8 and python:3.9 container images if used to build web services such as Django with GIS extensions may have an RCE until Python.org sources are updated.
Earlier quoted context omitted.
The python:3.8 and python:3.9 container images if used to build web services such as Django with GIS extensions may have an RCE until Python.org sources are updated.
Why can't the base image receive those patches as well?
https://github.com/docker-library/python/blob/master/3.8/bus...
Minimal example: >>> import ctypes >>> x = ctypes.c_double.from_param(1e300) >>> repr(x) Segmentation fault This happens when getting the string representation of a foreign function float. It doesn't affect the standard builtin float type. So it's not extremely common. But I can imagine this cropping up if you e.g. find a way to cause an exception that formats a value. Or if there's aggressive logging.