Bug 2330804 (CVE-2024-12254) - CVE-2024-12254 python: Unbounded memory buffering in SelectorSocketTransport.writelines()
Summary: CVE-2024-12254 python: Unbounded memory buffering in SelectorSocketTransport....
Keywords:
Status: NEW
Alias: CVE-2024-12254
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2330923 2330924 2330925 2330926 2330927 2330928
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-12-06 16:01 UTC by OSIDB Bzimport
Modified: 2025-04-11 10:51 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:10978 0 None None None 2024-12-12 08:38:18 UTC
Red Hat Product Errata RHSA-2024:10980 0 None None None 2024-12-12 08:50:31 UTC
Red Hat Product Errata RHSA-2024:11035 0 None None None 2024-12-13 09:15:04 UTC

Description OSIDB Bzimport 2024-12-06 16:01:17 UTC
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()
 method would not "pause" writing and signal to the Protocol to drain 
the buffer to the wire once the write buffer reached the "high-water 
mark". Because of this, Protocols would not periodically drain the write
 buffer potentially leading to memory exhaustion.





This
 vulnerability likely impacts a small number of users, you must be using
 Python 3.12.0 or later, on macOS or Linux, using the asyncio module 
with protocols, and using .writelines() method which had new 
zero-copy-on-write behavior in Python 3.12.0 and later. If not all of 
these factors are true then your usage of Python is unaffected.

Comment 2 errata-xmlrpc 2024-12-12 08:38:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:10978 https://access.redhat.com/errata/RHSA-2024:10978

Comment 3 errata-xmlrpc 2024-12-12 08:50:30 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:10980 https://access.redhat.com/errata/RHSA-2024:10980

Comment 4 errata-xmlrpc 2024-12-13 09:15:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2024:11035 https://access.redhat.com/errata/RHSA-2024:11035


Note You need to log in before you can comment on or make changes to this bug.