Pure-Python implementation of socket.socketpair() doesn't authenticate connected socket #122133

sethmlarson · 2024-07-22T18:09:05Z

Bug report

Bug description:

socket.socketpair() has a fall-back implementation on platforms that don't support socket.AF_UNIX which uses AF_INET[6] sockets bound to localhost. This connection is expected to come from the same process.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux, Windows

Linked PRs

gh-122133: Authenticate socket connection for socket.socketpair() fallback #122134
[3.13] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122424
[3.12] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122425
[3.11] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122426
[3.10] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122427
[3.9] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122428
[3.8] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122429
gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. #122493
[3.13] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122504
[3.12] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122505
[3.11] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122506
[3.10] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122507
[3.9] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122508
[3.8] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122509

The text was updated successfully, but these errors were encountered:

…allback (GH-122134) * Authenticate socket connection for `socket.socketpair()` fallback when the platform does not have a native `socketpair` C API. We authenticate in-process using `getsocketname` and `getpeername` (thanks to Nathaniel J Smith for that suggestion). Co-authored-by: Gregory P. Smith <greg@krypto.org>

…r()` fallback (pythonGH-122134) * Authenticate socket connection for `socket.socketpair()` fallback when the platform does not have a native `socketpair` C API. We authenticate in-process using `getsocketname` and `getpeername` (thanks to Nathaniel J Smith for that suggestion). (cherry picked from commit 78df104) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org>

…ir()` fallback (GH-122134) (GH-122425) Authenticate socket connection for `socket.socketpair()` fallback when the platform does not have a native `socketpair` C API. We authenticate in-process using `getsocketname` and `getpeername` (thanks to Nathaniel J Smith for that suggestion). (cherry picked from commit 78df104) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org>

…ir()` fallback (GH-122134) (GH-122424) Authenticate socket connection for `socket.socketpair()` fallback when the platform does not have a native `socketpair` C API. We authenticate in-process using `getsocketname` and `getpeername` (thanks to Nathaniel J Smith for that suggestion). (cherry picked from commit 78df104) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org>

…ir()` fallback (GH-122134) (#122426) Authenticate socket connection for `socket.socketpair()` fallback when the platform does not have a native `socketpair` C API. We authenticate in-process using `getsocketname` and `getpeername` (thanks to Nathaniel J Smith for that suggestion). (cherry picked from commit 78df104) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org>

…ir()` fallback (GH-122134) (#122427) Authenticate socket connection for `socket.socketpair()` fallback when the platform does not have a native `socketpair` C API. We authenticate in-process using `getsocketname` and `getpeername` (thanks to Nathaniel J Smith for that suggestion). (cherry picked from commit 78df104) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org>

…r()` fallback (GH-122134) (#122428) Authenticate socket connection for `socket.socketpair()` fallback when the platform does not have a native `socketpair` C API. We authenticate in-process using `getsocketname` and `getpeername` (thanks to Nathaniel J Smith for that suggestion). (cherry picked from commit 78df104) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org>

…r()` fallback (GH-122134) (GH-122429) Authenticate socket connection for `socket.socketpair()` fallback when the platform does not have a native `socketpair` C API. We authenticate in-process using `getsocketname` and `getpeername` (thanks to Nathaniel J Smith for that suggestion). (cherry picked from commit 78df104) Co-authored-by: Seth Michael Larson <seth@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Łukasz Langa <lukasz@langa.pl>

…lib.reload. (#122493) Co-authored-by: Gregory P. Smith <greg@krypto.org>

…importlib.reload. (pythonGH-122493) (cherry picked from commit f071f01) Co-authored-by: Russell Keith-Magee <russell@keith-magee.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>

… importlib.reload. (GH-122493) (#122504) gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) (cherry picked from commit f071f01) Co-authored-by: Russell Keith-Magee <russell@keith-magee.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>

… importlib.reload. (GH-122493) (GH-122505) gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) (cherry picked from commit f071f01) Co-authored-by: Russell Keith-Magee <russell@keith-magee.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>

… importlib.reload. (GH-122493) (GH-122506) (cherry picked from commit f071f01) Co-authored-by: Russell Keith-Magee <russell@keith-magee.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>

… importlib.reload. (GH-122493) (GH-122507) (cherry picked from commit f071f01) Co-authored-by: Russell Keith-Magee <russell@keith-magee.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>

…importlib.reload. (GH-122493) (GH-122508) (cherry picked from commit f071f01) Co-authored-by: Russell Keith-Magee <russell@keith-magee.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>

…importlib.reload. (GH-122493) (GH-122509) (cherry picked from commit f071f01) Co-authored-by: Russell Keith-Magee <russell@keith-magee.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>

cfi-gb · 2024-08-12T13:55:46Z

Only for (easier) tracking purposes (because searching for this CVE doesn't yield any results in this repo), it seems CVE-2024-3219 is now linked to this issue:

…importlib.reload. (python#122493) Co-authored-by: Gregory P. Smith <greg@krypto.org>

sethmlarson added type-bug An unexpected behavior, bug, or error type-security A security issue labels Jul 22, 2024

bedevere-app bot mentioned this issue Jul 22, 2024

gh-122133: Authenticate socket connection for socket.socketpair() fallback #122134

Merged

bedevere-app bot mentioned this issue Jul 29, 2024

[3.13] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122424

Merged

bedevere-app bot mentioned this issue Jul 29, 2024

[3.12] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122425

Merged

This was referenced Jul 29, 2024

[3.11] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122426

Merged

[3.10] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122427

Merged

This was referenced Jul 29, 2024

[3.9] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122428

Merged

[3.8] gh-122133: Authenticate socket connection for socket.socketpair() fallback (GH-122134) #122429

Merged

bedevere-app bot mentioned this issue Jul 31, 2024

gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. #122493

Merged

Yhg1s pushed a commit that referenced this issue Jul 31, 2024

gh-122133: Rework pure Python socketpair tests to avoid use of import…

f071f01

…lib.reload. (#122493) Co-authored-by: Gregory P. Smith <greg@krypto.org>

bedevere-app bot mentioned this issue Jul 31, 2024

[3.13] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122504

Merged

bedevere-app bot mentioned this issue Jul 31, 2024

[3.12] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122505

Merged

bedevere-app bot mentioned this issue Jul 31, 2024

[3.11] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122506

Merged

bedevere-app bot mentioned this issue Jul 31, 2024

[3.10] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122507

Merged

This was referenced Jul 31, 2024

[3.9] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122508

Merged

[3.8] gh-122133: Rework pure Python socketpair tests to avoid use of importlib.reload. (GH-122493) #122509

Merged

ambv closed this as completed Aug 2, 2024

ell1e mentioned this issue Aug 7, 2024

socketpair() bugfix leaves ability for attacker to infinitely block the function under some limited circumstances #122797

Closed

blhsing pushed a commit to blhsing/cpython that referenced this issue Aug 22, 2024

pythongh-122133: Rework pure Python socketpair tests to avoid use of …

23ed3cf

…importlib.reload. (python#122493) Co-authored-by: Gregory P. Smith <greg@krypto.org>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pure-Python implementation of socket.socketpair() doesn't authenticate connected socket #122133

Pure-Python implementation of socket.socketpair() doesn't authenticate connected socket #122133

sethmlarson commented Jul 22, 2024 •

edited by bedevere-app bot

Loading

cfi-gb commented Aug 12, 2024

Pure-Python implementation of socket.socketpair() doesn't authenticate connected socket #122133

Pure-Python implementation of socket.socketpair() doesn't authenticate connected socket #122133

Comments

sethmlarson commented Jul 22, 2024 • edited by bedevere-app bot Loading

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

cfi-gb commented Aug 12, 2024

sethmlarson commented Jul 22, 2024 •

edited by bedevere-app bot

Loading