Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

gh-143309: fix UAF inos.execve when the environment is concurrently mutated#143314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
picnixz merged 13 commits intopython:mainfrompicnixz:fix/os/uaf-in-os-execve-143309
Jan 3, 2026

Conversation

@picnixz
Copy link
Member

@picnixzpicnixz commentedDec 31, 2025
edited by bedevere-appbot
Loading

@picnixz
Copy link
MemberAuthor

Mmh. This is tricky for Windows. I don't have a Windows machine to know what happened there.

@picnixz
Copy link
MemberAuthor

@chris-eibl I know you're on Windows, so could you help me there please?

@chris-eibl
Copy link
Member

Will have a closer look tomorrow

picnixz reacted with heart emoji

@picnixzpicnixzforce-pushed thefix/os/uaf-in-os-execve-143309 branch from17b706f tobe3bd3dCompareJanuary 1, 2026 11:48
@picnixzpicnixz requested a review fromsobolevnJanuary 1, 2026 11:48
@chris-eibl
Copy link
Member

chris-eibl commentedJan 1, 2026
edited
Loading

@chris-eibl I know you're on Windows, so could you help me there please?

Ups, really tricky on Windows. I've found two different issues:

Edit: Created#143327

Details

The test case boils down to this smallest reproducer I can get:

importos,sysimportsubprocesscode="""import os, sysargs = [sys.executable, '-c', 'print(4711)']os.execve(args[0], args, {})"""cmd_line= [sys.executable,'-X','faulthandler','-c',code]env_1=os.environ.copy()env_2= {}env_2['SYSTEMROOT']=os.environ['SYSTEMROOT']proc=subprocess.Popen(cmd_line,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,env=env_1)withproc:try:out,err=proc.communicate()finally:proc.kill()subprocess._cleanup()print("rc",proc.returncode)print("out",out)print("err",err)

Usingenv_1 crashes for me like in CI, interestingly the "smaller"env_2 works. It seems to be the combination ofsubprocess andos.execve. Withoutsubprocess, I do not see this problem.

@picnixz
Copy link
MemberAuthor

Oh, so the problem issubprocess but not my fix?

chris-eibl reacted with thumbs up emoji

@chris-eibl
Copy link
Member

chris-eibl commentedJan 1, 2026
edited
Loading

Secondly, theos.execv* family has problems with strings on Windows:

Edit: created#143328

Details

importosimportsysargs= [sys.executable,'-c','print("hello from execve")']os.execve(args[0],args, {})

This results in

    print(hello from execve)                ^^^^SyntaxError: invalid syntax

And using"print('hello from execve')" results in

    print('hello          ^SyntaxError: unterminated string literal (detected at line 1)

Both work like expected in WSL. The only thing that somewhat works is omitting the spaces"print('hellofromexecve')" :-o

@chris-eibl
Copy link
Member

I haven't found these two things reported as issues, yet, I think I should create two new issues?

With the above in mind, changing your test slightly to:

args= [sys.executable,'-c',"print('hellofromexecve')"]os.execve(args[0],args,MyEnv())"""        env = {}        env['__cleanenv'] = True  # signal to assert_python not to do a copy                                  # of os.environ on its own        rc, out, _ = assert_python_ok('-c', code, **env)        self.assertEqual(rc, 0)        self.assertIn(b"hellofromexecve",out)

let's it pass for me. Without your fix applied, it will fail with an access violation, due to the UAF 🚀

@picnixz
Copy link
MemberAuthor

picnixz commentedJan 1, 2026
edited
Loading

I haven't found these two things reported as issues, yet, I think I should create two new issues?

Please do so and thank you for all this investigation!

@chris-eibl
Copy link
Member

Oh, Win x64 now almost green in CI like for me. Unfortunately, arm64 and Win32 still crash. I will look at Win32, do not have an Arm machine ...

@chris-eibl
Copy link
Member

Sorry, didn't want to also apply my suggestion - just suggest. Misclicked, hangover from yesterday ...

@picnixz
Copy link
MemberAuthor

You're hijacking my code! 😨

@picnixz
Copy link
MemberAuthor

Could the issue on Windows and general be caused by this:

        PyObject *keyval = PyUnicode_FromFormat("%U=%U", key2, val2);

@chris-eibl
Copy link
Member

chris-eibl commentedJan 1, 2026
edited
Loading

You're hijacking my code! 😨

And already apologized. Misclicked. Sorry again.

arm64 and Win32 still crash

Win32 is green for me. I've run

python -m test.test_os.test_os ExecTests.test_execve_env_concurrent_mutation_with_fspath

5 times sucessfully ...

@picnixz
Copy link
MemberAuthor

Considering#137934, I think we will, for now, just skip the test on Windows. If evenos.execve is buggy in plain C, then there is nothing we can do on our side.

chris-eibl and johnslavik reacted with thumbs up emoji

@chris-eibl
Copy link
Member

I think we should debug what the environment passed toexecve (that is, afterparse_envlist) is called

Just for posterity: I can reproduce the crash for commit7b6e2db x64 ft locally. Right before the call of

fexecve(path->fd,argvlist,envlist);

the prameters look as expected:
image

Furthermore, they are identical in the x64 regular build. All the more hints that something is broken in Windows ucrt_wexec*e (#137934).

picnixz reacted with heart emoji

@picnixz
Copy link
MemberAuthor

Great to hear!

yihong0618 reacted with heart emoji

@picnixzpicnixz requested a review fromsobolevnJanuary 2, 2026 10:06
Copy link
Member

@sobolevnsobolevn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM, except one minor suggestion

Co-authored-by: sobolevn <mail@sobolevn.me>
@picnixzpicnixz merged commit9609574 intopython:mainJan 3, 2026
83 of 85 checks passed
@picnixzpicnixz deleted the fix/os/uaf-in-os-execve-143309 branchJanuary 3, 2026 22:06
@miss-islington-app
Copy link

Thanks@picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestJan 3, 2026
…rrently mutated (pythonGH-143314)(cherry picked from commit9609574)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestJan 3, 2026
…rrently mutated (pythonGH-143314)(cherry picked from commit9609574)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
@bedevere-app
Copy link

GH-143398 is a backport of this pull request to the3.14 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.14bugs and security fixes labelJan 3, 2026
@bedevere-app
Copy link

GH-143399 is a backport of this pull request to the3.13 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.13bugs and security fixes labelJan 3, 2026
picnixz added a commit that referenced this pull requestJan 3, 2026
…urrently mutated (GH-143314) (#143398)gh-143309: fix UAF in `os.execve` when the environment is concurrently mutated (GH-143314)(cherry picked from commit9609574)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
@picnixz
Copy link
MemberAuthor

picnixz commentedJan 3, 2026
edited
Loading

Oh I broke some build bots:

/home/buildbot/buildarea/3.x.cstratak-fedora-stable-x86_64/build/build_oot/python: error while loading shared libraries: libpython3.15d.so.1.0: cannot open shared object file: No such file or directory

I don't know what happened here though but it looks like changing some environment wasn't the best. Maybe I should skip build bots? (I will take care of this failure tomorrow)

picnixz added a commit to picnixz/cpython that referenced this pull requestJan 5, 2026
…s concurrently mutated (pythonGH-143314)(cherry picked from commit9609574)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
picnixz added a commit to picnixz/cpython that referenced this pull requestJan 5, 2026
picnixz added a commit to picnixz/cpython that referenced this pull requestJan 5, 2026
…s concurrently mutated (python#143314) (python#143415)(cherry picked from commit9609574)(cherry picked from commitc99f766)
@bedevere-app
Copy link

GH-143431 is a backport of this pull request to the3.13 branch.

picnixz added a commit that referenced this pull requestJan 5, 2026
…urrently mutated (GH-143314) (#143431)[3.13]gh-143309: fix UAF in `os.execve` when the environment is concurrently mutated (GH-143314) (#143431)(cherry picked from commit9609574)(cherry picked from commitc99f766)
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@sobolevnsobolevnsobolevn approved these changes

@chris-eiblchris-eiblchris-eibl approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@picnixz@chris-eibl@sobolevn

[8]ページ先頭

©2009-2026 Movatter.jp