Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork34k
gh-143309: fix UAF inos.execve when the environment is concurrently mutated#143314
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
picnixz commentedDec 31, 2025
Mmh. This is tricky for Windows. I don't have a Windows machine to know what happened there. |
picnixz commentedDec 31, 2025
@chris-eibl I know you're on Windows, so could you help me there please? |
chris-eibl commentedDec 31, 2025
Will have a closer look tomorrow |
Uh oh!
There was an error while loading.Please reload this page.
17b706f tobe3bd3dCompareUh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
chris-eibl commentedJan 1, 2026 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
Ups, really tricky on Windows. I've found two different issues: Edit: Created#143327 DetailsThe test case boils down to this smallest reproducer I can get: importos,sysimportsubprocesscode="""import os, sysargs = [sys.executable, '-c', 'print(4711)']os.execve(args[0], args, {})"""cmd_line= [sys.executable,'-X','faulthandler','-c',code]env_1=os.environ.copy()env_2= {}env_2['SYSTEMROOT']=os.environ['SYSTEMROOT']proc=subprocess.Popen(cmd_line,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,env=env_1)withproc:try:out,err=proc.communicate()finally:proc.kill()subprocess._cleanup()print("rc",proc.returncode)print("out",out)print("err",err) Using |
picnixz commentedJan 1, 2026
Oh, so the problem is |
chris-eibl commentedJan 1, 2026 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
Secondly, the Edit: created#143328 Detailsimportosimportsysargs= [sys.executable,'-c','print("hello from execve")']os.execve(args[0],args, {}) This results in And using Both work like expected in WSL. The only thing that somewhat works is omitting the spaces |
chris-eibl commentedJan 1, 2026
I haven't found these two things reported as issues, yet, I think I should create two new issues? With the above in mind, changing your test slightly to: args= [sys.executable,'-c',"print('hellofromexecve')"]os.execve(args[0],args,MyEnv())""" env = {} env['__cleanenv'] = True # signal to assert_python not to do a copy # of os.environ on its own rc, out, _ = assert_python_ok('-c', code, **env) self.assertEqual(rc, 0) self.assertIn(b"hellofromexecve",out) let's it pass for me. Without your fix applied, it will fail with an access violation, due to the UAF 🚀 |
picnixz commentedJan 1, 2026 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
Please do so and thank you for all this investigation! |
chris-eibl commentedJan 1, 2026
Oh, Win x64 now almost green in CI like for me. Unfortunately, arm64 and Win32 still crash. I will look at Win32, do not have an Arm machine ... |
Uh oh!
There was an error while loading.Please reload this page.
chris-eibl commentedJan 1, 2026
Sorry, didn't want to also apply my suggestion - just suggest. Misclicked, hangover from yesterday ... |
picnixz commentedJan 1, 2026
You're hijacking my code! 😨 |
picnixz commentedJan 1, 2026
Could the issue on Windows and general be caused by this: |
chris-eibl commentedJan 1, 2026 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
And already apologized. Misclicked. Sorry again.
Win32 is green for me. I've run 5 times sucessfully ... |
picnixz commentedJan 1, 2026
Considering#137934, I think we will, for now, just skip the test on Windows. If even |
chris-eibl commentedJan 1, 2026
Just for posterity: I can reproduce the crash for commit7b6e2db x64 ft locally. Right before the call of Line 7564 infaa2604
the prameters look as expected: ![]() Furthermore, they are identical in the x64 regular build. All the more hints that something is broken in Windows ucrt |
picnixz commentedJan 1, 2026
Great to hear! |
Misc/NEWS.d/next/Library/2025-12-31-20-43-02.gh-issue-143309.cdFxdH.rst OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
sobolevn left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
LGTM, except one minor suggestion
Uh oh!
There was an error while loading.Please reload this page.
Co-authored-by: sobolevn <mail@sobolevn.me>
9609574 intopython:mainUh oh!
There was an error while loading.Please reload this page.
Thanks@picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14. |
…rrently mutated (pythonGH-143314)(cherry picked from commit9609574)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
…rrently mutated (pythonGH-143314)(cherry picked from commit9609574)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
GH-143398 is a backport of this pull request to the3.14 branch. |
GH-143399 is a backport of this pull request to the3.13 branch. |
picnixz commentedJan 3, 2026 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
Oh I broke some build bots:
I don't know what happened here though but it looks like changing some environment wasn't the best. Maybe I should skip build bots? (I will take care of this failure tomorrow) |
…s concurrently mutated (pythonGH-143314)(cherry picked from commit9609574)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
…s concurrently mutated (python#143314) (python#143415)
…s concurrently mutated (python#143314) (python#143415)(cherry picked from commit9609574)(cherry picked from commitc99f766)
GH-143431 is a backport of this pull request to the3.13 branch. |

Uh oh!
There was an error while loading.Please reload this page.
parse_envlistvia re-entrantenv.keys()orenv.values()#143309