Use-after-free in `{Attribute,Name,Import}Error` suggestion generation

[stratakis]

Crash report

What happened?

Summary

This is a Use-after-free (CWE-416), interpreter crash. Only reachable by running crafted Python, which per the Python security policy is not a security boundary, so opening it as a regular bug per the request of the Python Security team.

The "Did you mean: ...?" suggestion helpers in Python/suggestions.c hold borrowed references to exception fields across PyObject_Dir(), which can run arbitrary Python. Re-entrant code that reassigns those fields frees them mid-use, causing a use-after-free during exception display. Affects 3.10-3.12.

Details

_PyErr_PrintEx() sets sys.last_value to the live exception before display, which reaches get_suggestions_for_attribute_error():

    PyObject *name = exc->name;         // borrowed
    PyObject *dir = PyObject_Dir(obj);  // runs obj.__dir__() -> arbitrary Python
    calculate_suggestions(dir, name);   // uses stale `name`

AttributeError.name is a T_OBJECT member whose setter decrefs the old value, so code in obj.__dir__() can reach the exception via sys.last_value, do exc.name = ..., and free the borrowed string before calculate_suggestions() dereferences it. Same pattern in the NameError and ImportError paths.

PoC

      import sys
      def fresh_name():
          return ("X" * (4 * 1024 * 1024)) + "!"   # mmap'd -> munmap on free
      class Evil:
          def __dir__(self):
              exc = getattr(sys, "last_value", None)
              if isinstance(exc, AttributeError):
                  exc.name = "replaced"; exc.obj = None
              return ["x"] 
      raise AttributeError("boom", name=fresh_name(), obj=Evil()

python3.12 repro.py -> SIGSEGV in PyUnicode_AsUTF8AndSize <- calculate_suggestions.

Fixed incidentally in 3.13 (#110721 which moved display to the traceback module). Only 3.10-3.12 need the strong-reference fix.

CPython versions tested on:

3.10, 3.11, 3.12

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

No response

Linked PRs

• [3.12] gh-157947: Keep exception fields alive during suggestion lookups #157973

[StanFromIreland]

Only 3.10-3.12 need the strong-reference fix.

This does not qualify as a vulnerability per our security policy (an attacker can't really exploit this), see discussion on the GHSA for more information. Leaving it up to the RM's as to whether they'd like to fix this on their branches.

CC @pablogsal @Yhg1s

[picnixz]

I do not think it is worth it