CPython 3.13-3.15 concurrency and memory-safety issue reports
まだ誰も着手していません。
- 主要言語
- Python
- スター
- 77.2k
- フォーク
- 35.9k
- PR マージ指標
- PR 指標を取得中
説明
Hello!
We are a team conducting Python security research. Recently, we investigated concurrency behavior in CPython and identified a set of reproducible correctness, concurrency, and memory-safety issues.
We evaluated free-threaded (FT) and conventional GIL-enabled builds separately. The confirmed findings cover CPython 3.13, 3.14, and 3.15. Across both build modes and releases, we identified 142 unique bugs in total.
Of these, 139 were confirmed in free-threaded builds and 34 were confirmed in conventional GIL-enabled builds. These two groups overlap: 31 bugs were confirmed in both build modes, while 3 were confirmed only in GIL-enabled builds.
The findings affect 29 library or extension components, 61 logical components, and 75 C source files. They primarily include Race Condition (CWE-362), TOCTOU Race Condition (CWE-367), Use After Free (CWE-416), and Improper Control of a Resource Through its Lifetime (CWE-664).
We have prepared a GitHub repository containing detailed bug reports, PoCs, and a comprehensive summary:
https://github.com/BaihongChen/cpython-concurrency-bugs
Complete component coverage
| Component | Category | 3.13 | 3.14 | 3.15 |
|---|---|---|---|---|
_remote_debugging |
Library/extension | — | — | ✓ |
array |
Library/extension | ✓ | ✓ | ✓ |
asyncio |
Library/extension | ✓ | — | — |
atexit |
Library/extension | ✓ | — | — |
collections |
Library/extension | ✓ | ✓ | ✓ |
compression.zstd |
Library/extension | — | ✓ | ✓ |
csv |
Library/extension | ✓ | — | — |
ctypes |
Library/extension | ✓ | ✓ | ✓ |
curses |
Library/extension | — | ✓ | — |
decimal |
Library/extension | ✓ | ✓ | — |
_suggestions / error suggestions |
Library/extension | ✓ | ✓ | — |
functools |
Library/extension | ✓ | ✓ | ✓ |
io |
Library/extension | ✓ | ✓ | — |
itertools |
Library/extension | ✓ | ✓ | ✓ |
json |
Library/extension | ✓ | ✓ | — |
locale |
Library/extension | — | ✓ | — |
| multibyte codecs | Library/extension | ✓ | ✓ | ✓ |
os |
Library/extension | ✓ | ✓ | ✓ |
pickle |
Library/extension | ✓ | ✓ | ✓ |
pyexpat |
Library/extension | ✓ | ✓ | ✓ |
re |
Library/extension | ✓ | ✓ | ✓ |
select |
Library/extension | ✓ | ✓ | ✓ |
sqlite3 |
Library/extension | ✓ | ✓ | ✓ |
ssl |
Library/extension | ✓ | ✓ | ✓ |
struct |
Library/extension | ✓ | ✓ | ✓ |
subprocess |
Library/extension | ✓ | ✓ | ✓ |
syslog |
Library/extension | ✓ | ✓ | ✓ |
termios |
Library/extension | ✓ | ✓ | ✓ |
tkinter |
Library/extension | ✓ | ✓ | ✓ |
xml.etree.ElementTree |
Library/extension | ✓ | ✓ | ✓ |
bytearray |
Built-in/core | ✓ | ✓ | ✓ |
bytes |
Built-in/core | ✓ | ✓ | ✓ |
| call protocol | Built-in/core | ✓ | ✓ | ✓ |
collections.OrderedDict |
Built-in/core | ✓ | ✓ | ✓ |
dict |
Built-in/core | ✓ | ✓ | ✓ |
| exceptions | Built-in/core | ✓ | ✓ | ✓ |
float |
Built-in/core | ✓ | ✓ | ✓ |
| frame | Built-in/core | ✓ | ✓ | ✓ |
| function | Built-in/core | ✓ | ✓ | ✓ |
| generator | Built-in/core | — | ✓ | — |
int |
Built-in/core | ✓ | ✓ | ✓ |
memoryview |
Built-in/core | ✓ | ✓ | ✓ |
| module | Built-in/core | ✓ | ✓ | ✓ |
| object protocol | Built-in/core | ✓ | ✓ | ✓ |
str |
Built-in/core | ✓ | ✓ | ✓ |
| struct sequence | Built-in/core | ✓ | ✓ | ✓ |
type |
Built-in/core | ✓ | ✓ | — |
ast |
Runtime/compiler | ✓ | ✓ | ✓ |
| C argument parsing | Runtime/compiler | ✓ | ✓ | ✓ |
| codec registry | Runtime/compiler | ✓ | ✓ | ✓ |
| compile/exec | Runtime/compiler | ✓ | ✓ | ✓ |
| compiler/evaluator | Runtime/compiler | ✓ | ✓ | ✓ |
contextvars |
Runtime/compiler | ✓ | ✓ | ✓ |
| cross-interpreter data | Runtime/compiler | ✓ | ✓ | ✓ |
| garbage collection | Runtime/compiler | ✓ | ✓ | ✓ |
| import machinery | Runtime/compiler | ✓ | ✓ | ✓ |
marshal |
Runtime/compiler | ✓ | ✓ | ✓ |
PyConfig |
Runtime/compiler | ✓ | ✓ | ✓ |
| runtime finalization | Runtime/compiler | ✓ | ✓ | ✓ |
sys |
Runtime/compiler | ✓ | ✓ | ✓ |
| traceback | Runtime/compiler | ✓ | ✓ | ✓ |
| warnings | Runtime/compiler | ✓ | — | — |
We hope these issues can be further confirmed and fixed in future releases. Thank you!
コントリビューションガイド
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
調査の方向性
リンクされた cpython-concurrency-bugs リポジトリから始め、詳細なレポート、PoC、概要を読み、すべてに対処するのではなく、再現可能な問題を1つ選択します。その問題を影響を受ける CPython コンポーネントと C ソースファイルまで追跡し、その PoC を使って問題を確認します。完了とは、特定のバグが修正され、PoC で再現しなくなった状態を意味します。
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- c, python
- 領域
- compilers, security
- issue の種類
- バグ
- 難易度
- 5/5
- 見積もり時間
- 1週間以上
- 活発さ
- 活発
- 明瞭さ
- 説明が足りない
- 初心者へのやさしさ
- 18/100