gh-143988: tation crashes in socket sendmsg/recvmsg_into via `buffer` #143987

tonghuaroot · 2026-01-18T06:53:37Z

Summary

This PR fixes two heap out-of-bounds read vulnerabilities in socket.sendmsg() and socket.recvmsg_into() that are related to gh-143637.

While gh-143637 addresses the __index__ re-entrancy issue in sendmsg() ancillary data parsing (argument 2), there are two additional vulnerable code paths that use the __buffer__ protocol:

socket.sendmsg() argument 1 (data buffers) - in sock_sendmsg_iovec()
socket.recvmsg_into() argument 1 (buffers) - in sock_recvmsg_into()

Root Cause

The vulnerability occurs because:

PySequence_Fast() returns the original list object when the input is already a list (not a copy)
During iteration, PyObject_GetBuffer() triggers __buffer__ protocol callbacks which may clear the list
Subsequent iterations access invalid memory (heap OOB read), leading to a crash (SIGSEGV)

Proof of Concept

`sendmsg()` data buffers crash:

import socket

seq = []

class MutBuffer:
    def __init__(self, data):
        self._data = bytes(data)
        self.tripped = False
    
    def __buffer__(self, flags):
        if not self.tripped:
            self.tripped = True
            seq.clear()  # Clear during iteration!
        return memoryview(self._data)

seq[:] = [MutBuffer(b'Hello'), b'World', b'Test']
left, right = socket.socketpair()
left.sendmsg(seq)  # CRASH: SIGSEGV

`recvmsg_into()` buffers crash:

import socket

seq = []

class MutBuffer:
    def __init__(self, data):
        self._data = bytearray(data)
        self.tripped = False
    
    def __buffer__(self, flags):
        if not self.tripped:
            self.tripped = True
            seq.clear()  # Clear during iteration!
        return memoryview(self._data)

seq[:] = [MutBuffer(b'x' * 100), bytearray(100), bytearray(100)]
left, right = socket.socketpair()
left.send(b'Hello World!')
right.recvmsg_into(seq)  # CRASH: SIGSEGV

Fix

Replace PySequence_Fast() with PySequence_Tuple() which always creates a new tuple, ensuring the sequence cannot be mutated during iteration.

Testing

Added Lib/test/test_socket_reentrant.py with regression tests for both vulnerable code paths.

Note: This is related to but separate from PR #143892 which fixes the __index__ issue.

Issue: socket.sendmsg() and socket.recvmsg_into() crash via __buffer__ re-entrancy (related to gh-143637) #143988

Lib/test/test_socket_reentrant.py

bedevere-app · 2026-01-18T22:53:46Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

And if you don't make the requested changes, you will be poked with soft cushions!

tonghuaroot · 2026-01-19T02:26:33Z

I have made the requested changes; please review again.

bedevere-app · 2026-01-19T02:26:39Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

picnixz · 2026-01-19T02:24:07Z

Lib/test/test_socket.py

+            try:
+                left.sendmsg(seq)
+            except (TypeError, OSError):
+                pass  # Expected - the important thing is no crash


In this case use assertRaises.

picnixz · 2026-01-19T02:24:31Z

Lib/test/test_socket.py

+                left.sendmsg(seq)
+            except (TypeError, OSError):
+                pass  # Expected - the important thing is no crash
+        finally:


Instead of finally, use addCleanup.

picnixz · 2026-01-19T02:24:51Z

Lib/test/test_socket.py

+        seq[:] = [
+            MutBuffer(b'Hello'),
+            b'World',
+            b'Test',
+        ]
+


Make it on one line..It is short enough. And no need for a slice replacement. You can just write seq = ... (or would there be some NameError?)

picnixz · 2026-01-19T02:26:12Z

Lib/test/test_socket.py

+
+    @unittest.skipUnless(hasattr(socket.socket, "sendmsg"),
+                         "sendmsg not supported")
+    def test_sendmsg_reentrant_data_mutation(self):


Add a refwrence to the gh issue as well. Using plain comments and

"See: URL TO THE ISSUE."

And not just gh-XXXXXX. URLs can be opened directly from IDEs, but not gh-* objects.

picnixz · 2026-01-19T02:30:04Z

Lib/test/test_socket.py

+
+        class MutBuffer:
+            def __init__(self, data):
+                self._data = bytes(data)


I do not think you need an attribute. You can just return a memoryview on the fly.

bedevere-app · 2026-01-19T02:30:59Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

picnixz · 2026-01-19T02:32:32Z

Please read the devguide:

Do not forcepush.
Do not hit the "update branch" button if there is no need to (that is, if the CI is already green for the tests). it wastes resources and notifies everyone..

…cvmsg_into via __buffer__ Fix crashes in socket.sendmsg() and socket.recvmsg_into() that could occur if buffer sequences are mutated re-entrantly during argument parsing via __buffer__ protocol callbacks. The vulnerability occurs because: 1. PySequence_Fast() returns the original list object when the input is already a list (not a copy) 2. During iteration, PyObject_GetBuffer() triggers __buffer__ callbacks which may clear the list 3. Subsequent iterations access invalid memory (heap OOB read) The fix replaces PySequence_Fast() with PySequence_Tuple() which always creates a new tuple, ensuring the sequence cannot be mutated during iteration. This addresses two vulnerabilities related to pythongh-143637: - sendmsg() argument 1 (data buffers) - via __buffer__ - recvmsg_into() argument 1 (buffers) - via __buffer__

tonghuaroot · 2026-01-19T02:47:49Z

Please read the devguide:

Do not forcepush.

Do not hit the "update branch" button if there is no need to (that is, if the CI is already green for the tests). it wastes resources and notifies everyone..

Sorry about the force pushes - I'll use regular commits going forward. Thanks for the reminder about the devguide.

tonghuaroot · 2026-01-19T02:54:33Z

I have made the requested changes; please review again.

bedevere-app · 2026-01-19T02:54:39Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

picnixz · 2026-01-19T02:56:32Z

Lib/test/test_socket.py

+        # Should not crash. With the fix, the call succeeds;
+        # without the fix, it would crash (SIGSEGV).
+        try:
+            left.sendmsg(seq)
+        except (TypeError, OSError):
+            pass  # Also acceptable


Remove the useless comments. It is obvious that we do not want a crash. However, I want to know why we silence the exceptions. Ideally we want an exact exception catching (whatever it is) with assertRaises or there should be no exception at all.

picnixz · 2026-01-19T02:57:06Z

Lib/test/test_socket.py

+
+        class MutBuffer:
+            def __init__(self, data):
+                self._data = bytearray(data)


Here as well you do not need the attribute I guess.

picnixz · 2026-01-19T02:59:43Z

Misc/NEWS.d/next/Security/2026-01-18-06-42-47.gh-issue-143988.MtLtCP.rst

@@ -0,0 +1,3 @@
+Fixed crashes in :meth:`socket.socket.sendmsg` and :meth:`socket.socket.recvmsg_into`
+that could occur if buffer sequences are mutated re-entrantly during argument parsing


that could occur if buffer sequences are concurrently mutated

Remove argument parsing mention. It is an implementation detail.

We do not really use the term re-entrency. I do not share the definition of re-entrency and prefer using concurrently here (you do two things at the same time)

picnixz · 2026-01-19T03:07:35Z

Modules/socketmodule.c

    }
    for (; nbufs < nitems; nbufs++) {
-        if (!PyArg_Parse(PySequence_Fast_GET_ITEM(fast, nbufs),
+        if (!PyArg_Parse(PyTuple_GET_ITEM(fast, nbufs),


I am a bit confused with this one. There is nothing that checks for the fact that this really a buffer object or did I forget about PyArg_Parse?

bedevere-app bot added the awaiting review label Jan 18, 2026

tonghuaroot changed the title ~~Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into via __buffer__~~ gh-143988: tation crashes in socket sendmsg/recvmsg_into via __buffer__ Jan 18, 2026

bedevere-app bot mentioned this pull request Jan 18, 2026

socket.sendmsg() and socket.recvmsg_into() crash via __buffer__ re-entrancy (related to gh-143637) #143988

Open

tonghuaroot force-pushed the fix-socket-reentrant-mutation branch from 333ee07 to 78c18ed Compare January 18, 2026 06:58

picnixz requested changes Jan 18, 2026

View reviewed changes

Lib/test/test_socket_reentrant.py Outdated Show resolved Hide resolved

bedevere-app bot removed the awaiting review label Jan 18, 2026

bedevere-app bot added the awaiting changes label Jan 18, 2026

tonghuaroot force-pushed the fix-socket-reentrant-mutation branch from 78c18ed to 42ad743 Compare January 19, 2026 02:21

bedevere-app bot added awaiting change review and removed awaiting changes labels Jan 19, 2026

bedevere-app bot requested a review from picnixz January 19, 2026 02:26

picnixz requested changes Jan 19, 2026

View reviewed changes

bedevere-app bot added awaiting changes and removed awaiting change review labels Jan 19, 2026

tonghuaroot force-pushed the fix-socket-reentrant-mutation branch 2 times, most recently from 720a086 to 4b592ef Compare January 19, 2026 02:41

tonghuaroot force-pushed the fix-socket-reentrant-mutation branch from 4b592ef to 2c8aad6 Compare January 19, 2026 02:43

bedevere-app bot added awaiting change review and removed awaiting changes labels Jan 19, 2026

bedevere-app bot requested a review from picnixz January 19, 2026 02:54

picnixz reviewed Jan 19, 2026

View reviewed changes

tonghuaroot added 4 commits January 19, 2026 11:28

Simplify NEWS entry: use 'concurrently' instead of 're-entrantly'

e0f92e6

Simplify MutBuffer in recvmsg_into test: remove self._data

12c8272

Remove unnecessary comments and try/except - calls succeed after fix

b578feb

Merge branch 'main' into fix-socket-reentrant-mutation

df46bde

		@@ -0,0 +1,3 @@
		Fixed crashes in :meth:`socket.socket.sendmsg` and :meth:`socket.socket.recvmsg_into`
		that could occur if buffer sequences are mutated re-entrantly during argument parsing

Uh oh!

gh-143988: tation crashes in socket sendmsg/recvmsg_into via __buffer__ #143987

Are you sure you want to change the base?

gh-143988: tation crashes in socket sendmsg/recvmsg_into via __buffer__ #143987

Conversation

tonghuaroot commented Jan 18, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root Cause

Proof of Concept

sendmsg() data buffers crash:

recvmsg_into() buffers crash:

Fix

Testing

Uh oh!

Uh oh!

bedevere-app bot commented Jan 18, 2026

Uh oh!

tonghuaroot commented Jan 19, 2026

Uh oh!

bedevere-app bot commented Jan 19, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bedevere-app bot commented Jan 19, 2026

Uh oh!

picnixz commented Jan 19, 2026

Uh oh!

tonghuaroot commented Jan 19, 2026

Uh oh!

tonghuaroot commented Jan 19, 2026

Uh oh!

bedevere-app bot commented Jan 19, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

picnixz Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gh-143988: tation crashes in socket sendmsg/recvmsg_into via `buffer` #143987

gh-143988: tation crashes in socket sendmsg/recvmsg_into via `buffer` #143987

tonghuaroot commented Jan 18, 2026 •

edited by bedevere-app bot

Loading

`sendmsg()` data buffers crash:

`recvmsg_into()` buffers crash:

picnixz Jan 19, 2026 •

edited

Loading