Crash: UAF in task_call_step_soon in _asynciomodule.c (with admittedly ridiculous setup) #126080
Description
Crash report
What happened?
This is basically an extension to #125984 but it took me a bit to get a working PoC because I have never used asyncio.Task ever.
The crash is caused because of a missing incref before calling call_soon in task_call_step_soon which allows us to corrupt task_context in an evil __getattribute__ class func before handing it off to call_soon. There's probably a much simpler way to trigger the crash but this is the only working route I found.
import asyncio
import types
@types.coroutine
def gen():
# this just needs to stay alive after the first `send` call
global catcher
while True:
yield catcher
async def coro():
await gen()
# this class is used to help return early from the Task.__init__ function just after
# task_context gets set in the func
class EvilStr:
def __str__(self):
raise Exception("break")
class EvilLoop:
def get_debug(self):
return False
def is_running(self):
return True
def call_soon(self, cb, *, context):
# if it hasnt crashed for you at this point, you'll see this is the same obj that was just freed
print("in call_soon", context)
def __getattribute__(self, name):
global ctx
if name == "call_soon":
try:
# context needs to be `None` so that it uses Py_XSETREF instead of just using regular assignment
task.__init__(co, loop=loop, context=None, name=EvilStr())
except: pass
return object.__getattribute__(self, name)
class TaskWakeupCatch:
def __init__(self):
self._asyncio_future_blocking = True
def get_loop(self):
global loop
return loop
# as far as i know, this is the only way to get access to the `task_wakeup` function
# which is needed to abuse the UAF
def add_done_callback(self, cb, *, context):
global wakeup_fn
if wakeup_fn == None:
wakeup_fn = cb
class DelTracker:
def __del__(self):
print("deleting", self)
co = coro()
loop = EvilLoop()
catcher = TaskWakeupCatch()
wakeup_fn = None
task = asyncio.Task(co, loop=loop, eager_start=True, name="init")
# set ctx to any obj you want to use after free
# im using an obj that tells us when it's been freed so we can see the UAF in action
ctx = DelTracker()
try:
# use exception trick to return early from the init func just after task_context gets set
task.__init__(co, loop=loop, context=ctx, name=EvilStr())
except: pass
del ctx
minimal = lambda: ...
minimal.result = lambda: None # only needs to be a function that doesnt error
assert wakeup_fn is not None
wakeup_fn(minimal)Output:
deleting <__main__.DelTracker object at 0x7f28e01d5be0>
in call_soon <__main__.DelTracker object at 0x7f28e01d5be0>
Segmentation fault
I am on a version of python that doesn't include all the recent fixes to asyncio, so just to confirm I was triggering this via task_call_step_soon I made sure to check the crash backtrace in gdb.
#0 _PyWeakref_GetWeakrefCount (obj=0x7ffff6f6dbe0) at Objects/weakrefobject.c:52
#1 _PyWeakref_GetWeakrefCount (obj=0x7ffff6f6dbe0) at Objects/weakrefobject.c:42
#2 PyObject_ClearWeakRefs (object=0x7ffff6f6dbe0) at Objects/weakrefobject.c:1018
#3 0x00005555556daf9e in subtype_dealloc (self=0x7ffff6f6dbe0) at Objects/typeobject.c:2322
#4 0x00005555557c4ec7 in Py_DECREF (op=<optimized out>) at ./Include/object.h:949
#5 Py_XDECREF (op=<optimized out>) at ./Include/object.h:1042
#6 _PyFrame_ClearLocals (frame=0x7ffff7afa0a0) at Python/frame.c:104
#7 _PyFrame_ClearExceptCode (frame=0x7ffff7afa0a0) at Python/frame.c:129
#8 0x0000555555796d47 in clear_thread_frame (frame=0x7ffff7afa0a0, tstate=0x555555adfc60 <_PyRuntime+282976>)
at Python/ceval.c:1668
#9 _PyEval_FrameClearAndPop (tstate=0x555555adfc60 <_PyRuntime+282976>, frame=0x7ffff7afa0a0) at Python/ceval.c:1695
#10 0x00005555555db84f in _PyEval_EvalFrameDefault (tstate=0x7ffff6f6dd10, frame=0x7fffffffd680, throwflag=1437070368)
at Python/generated_cases.c.h:5204
#11 0x0000555555644638 in _PyObject_VectorcallTstate (kwnames=0x7ffff713db10, nargsf=2, args=0x7fffffffd7f0,
callable=0x7ffff6dc00e0, tstate=0x555555adfc60 <_PyRuntime+282976>) at ./Include/internal/pycore_call.h:168
#12 method_vectorcall (method=<optimized out>, args=0x7fffffffd7f8, nargsf=<optimized out>, kwnames=0x7ffff713db10)
at Objects/classobject.c:62
#13 0x0000555555641743 in _PyObject_VectorcallTstate (kwnames=0x7ffff713db10, nargsf=<optimized out>,
args=0x7fffffffd7f8, callable=0x7ffff6f588c0, tstate=0x555555adfc60 <_PyRuntime+282976>)
at ./Include/internal/pycore_call.h:168
#14 PyObject_VectorcallMethod (name=<optimized out>, args=0x7fffffffd7f8, args@entry=0x7fffffffd7f0,
nargsf=<optimized out>, nargsf@entry=9223372036854775810, kwnames=0x7ffff713db10) at Objects/call.c:856
#15 0x00007ffff7021504 in call_soon (ctx=<optimized out>, arg=0x0, func=0x7ffff6f5f100, loop=<optimized out>,
state=0x7ffff7098b30) at ./Modules/_asynciomodule.c:311
#16 task_call_step_soon (state=state@entry=0x7ffff7098b30, task=task@entry=0x7ffff6f54c00, arg=arg@entry=0x7ffff7a61b40)
at ./Modules/_asynciomodule.c:2677
#17 0x00007ffff70216a9 in task_set_error_soon (state=state@entry=0x7ffff7098b30, task=task@entry=0x7ffff6f54c00,
et=<optimized out>, format=<optimized out>) at ./Modules/_asynciomodule.c:2703
#18 0x00007ffff7022043 in task_step_handle_result_impl (result=<optimized out>, task=0x7ffff6f54c00,
state=0x7ffff7098b30) at ./Modules/_asynciomodule.c:3052
#19 task_step_impl (state=state@entry=0x7ffff7098b30, task=task@entry=0x7ffff6f54c00, exc=<optimized out>, exc@entry=0x0)
at ./Modules/_asynciomodule.c:2847
#20 0x00007ffff7023327 in task_step (state=0x7ffff7098b30, task=0x7ffff6f54c00, exc=0x0)
at ./Modules/_asynciomodule.c:3073
The fix for this is to just incref task->task_context before calling call_soon to avoid deleting it in the evil func
cpython/Modules/_asynciomodule.c
Lines 2676 to 2680 in 60403a5
CPython versions tested on:
3.13
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.13.0 (tags/v3.13.0:60403a5409f, Oct 10 2024, 09:24:12) [GCC 13.2.0]
Linked PRs
- gh-126080: fix UAF on
task->task_contextintask_call_step_soondue to an evilloop.__getattribute__#126120 - [3.13] gh-126080: fix UAF on
task->task_contextintask_call_step_soondue to an evilloop.__getattribute__(GH-126120) #126250 - [3.12] gh-126080: fix UAF on
task->task_contextintask_call_step_soondue to an evilloop.__getattribute__(GH-126120) #126251
Metadata
Metadata
Assignees
Labels
Projects
Status