CPython 3.13-3.15 concurrency and memory-safety issue reports

Aberta
#157,601 2 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
18/100
Tipo de issue
Bug
Clareza
Precisa de esclarecimento
Status de atividade
Ativa
Stack de tecnologia
c, python
Domínio
compilers, security

Direção de pesquisa

Comece pelo repositório cpython-concurrency-bugs, que está vinculado, leia seus relatórios detalhados, PoCs e resumo, e selecione uma descoberta reproduzível em vez de abordar o conjunto completo. Rastreie essa descoberta até o componente do CPython e o arquivo-fonte C afetados e, em seguida, use seu PoC para confirmar o problema; o trabalho estará concluído quando o bug específico estiver corrigido e o PoC não conseguir mais reproduzi-lo.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

3.13 3.14 3.15 extension-modules interpreter-core pending topic-free-threading type-bug

Hello!

We are a team conducting Python security research. Recently, we investigated concurrency behavior in CPython and identified a set of reproducible correctness, concurrency, and memory-safety issues.

We evaluated free-threaded (FT) and conventional GIL-enabled builds separately. The confirmed findings cover CPython 3.13, 3.14, and 3.15. Across both build modes and releases, we identified 142 unique bugs in total.

Of these, 139 were confirmed in free-threaded builds and 34 were confirmed in conventional GIL-enabled builds. These two groups overlap: 31 bugs were confirmed in both build modes, while 3 were confirmed only in GIL-enabled builds.

The findings affect 29 library or extension components, 61 logical components, and 75 C source files. They primarily include Race Condition (CWE-362), TOCTOU Race Condition (CWE-367), Use After Free (CWE-416), and Improper Control of a Resource Through its Lifetime (CWE-664).

We have prepared a GitHub repository containing detailed bug reports, PoCs, and a comprehensive summary:

https://github.com/BaihongChen/cpython-concurrency-bugs

Complete component coverage

Component Category 3.13 3.14 3.15
_remote_debugging Library/extension — — ✓
array Library/extension ✓ ✓ ✓
asyncio Library/extension ✓ — —
atexit Library/extension ✓ — —
collections Library/extension ✓ ✓ ✓
compression.zstd Library/extension — ✓ ✓
csv Library/extension ✓ — —
ctypes Library/extension ✓ ✓ ✓
curses Library/extension — ✓ —
decimal Library/extension ✓ ✓ —
_suggestions / error suggestions Library/extension ✓ ✓ —
functools Library/extension ✓ ✓ ✓
io Library/extension ✓ ✓ —
itertools Library/extension ✓ ✓ ✓
json Library/extension ✓ ✓ —
locale Library/extension — ✓ —
multibyte codecs Library/extension ✓ ✓ ✓
os Library/extension ✓ ✓ ✓
pickle Library/extension ✓ ✓ ✓
pyexpat Library/extension ✓ ✓ ✓
re Library/extension ✓ ✓ ✓
select Library/extension ✓ ✓ ✓
sqlite3 Library/extension ✓ ✓ ✓
ssl Library/extension ✓ ✓ ✓
struct Library/extension ✓ ✓ ✓
subprocess Library/extension ✓ ✓ ✓
syslog Library/extension ✓ ✓ ✓
termios Library/extension ✓ ✓ ✓
tkinter Library/extension ✓ ✓ ✓
xml.etree.ElementTree Library/extension ✓ ✓ ✓
bytearray Built-in/core ✓ ✓ ✓
bytes Built-in/core ✓ ✓ ✓
call protocol Built-in/core ✓ ✓ ✓
collections.OrderedDict Built-in/core ✓ ✓ ✓
dict Built-in/core ✓ ✓ ✓
exceptions Built-in/core ✓ ✓ ✓
float Built-in/core ✓ ✓ ✓
frame Built-in/core ✓ ✓ ✓
function Built-in/core ✓ ✓ ✓
generator Built-in/core — ✓ —
int Built-in/core ✓ ✓ ✓
memoryview Built-in/core ✓ ✓ ✓
module Built-in/core ✓ ✓ ✓
object protocol Built-in/core ✓ ✓ ✓
str Built-in/core ✓ ✓ ✓
struct sequence Built-in/core ✓ ✓ ✓
type Built-in/core ✓ ✓ —
ast Runtime/compiler ✓ ✓ ✓
C argument parsing Runtime/compiler ✓ ✓ ✓
codec registry Runtime/compiler ✓ ✓ ✓
compile/exec Runtime/compiler ✓ ✓ ✓
compiler/evaluator Runtime/compiler ✓ ✓ ✓
contextvars Runtime/compiler ✓ ✓ ✓
cross-interpreter data Runtime/compiler ✓ ✓ ✓
garbage collection Runtime/compiler ✓ ✓ ✓
import machinery Runtime/compiler ✓ ✓ ✓
marshal Runtime/compiler ✓ ✓ ✓
PyConfig Runtime/compiler ✓ ✓ ✓
runtime finalization Runtime/compiler ✓ ✓ ✓
sys Runtime/compiler ✓ ✓ ✓
traceback Runtime/compiler ✓ ✓ ✓
warnings Runtime/compiler ✓ — —

We hope these issues can be further confirmed and fixed in future releases. Thank you!

Linguagem predominante
Python
Estrelas
77.2k
Forks
36k
Merge médio
1d 9h
PRs com merge (30d)
558

Guia de contribuição

Abrir o guia de contribuição

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de python/cpython

Todas as issues de python/cpython

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.