Python Software CPython up to 3.14.0a0 asyncio._SelectorSocketTransport.writelines resource consumption

Summaryinfo

A vulnerability labeled as problematic has been found in Python Software CPython up to 3.14.0a0. Affected by this issue is the function asyncio._SelectorSocketTransport.writelines. The manipulation results in resource consumption. This vulnerability was named CVE-2024-12254. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Python Software CPython up to 3.14.0a0. It has been classified as problematic. Affected is the function asyncio._SelectorSocketTransport.writelines. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.

The advisory is available at github.com. This vulnerability is traded as CVE-2024-12254 since 12/05/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 212208 (Fedora 41 : python3.12 (2024-340a4bdc5d)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.14.0a1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (212208). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• Python Software

Name

• CPython

Version

• 3.14.0a0

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion