REDHAT-BUG-2457932: Use After Free
Use-after-free (UAF) was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a MemoryError and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.
The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a MemoryError is raised during decompression. Using the helper functions to one-shot decompress data such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and zlib.decompress() are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2457932?
The severity of REDHAT-BUG-2457932 is considered high due to the potential for a use-after-free vulnerability that can be exploited under memory pressure.
How do I fix REDHAT-BUG-2457932?
To fix REDHAT-BUG-2457932, update your Python installation to the latest version that addresses this memory allocation issue.
Which software is affected by REDHAT-BUG-2457932?
REDHAT-BUG-2457932 affects the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile components of Python.
What could happen if REDHAT-BUG-2457932 is exploited?
If exploited, REDHAT-BUG-2457932 could lead to unexpected application behavior, crashes, or the potential for remote code execution.
How can I determine if my environment is impacted by REDHAT-BUG-2457932?
You can determine if your environment is impacted by REDHAT-BUG-2457932 by checking if your application uses the affected components under conditions of high memory usage.