gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into via `__buffer__` by tonghuaroot · Pull Request #143987 · python/cpython

tonghuaroot · 2026-01-18T06:53:37Z

Summary

This PR fixes two heap out-of-bounds read vulnerabilities in socket.sendmsg() and socket.recvmsg_into() that are related to gh-143637.

While gh-143637 addresses the __index__ re-entrancy issue in sendmsg() ancillary data parsing (argument 2), there are two additional vulnerable code paths that use the __buffer__ protocol:

socket.sendmsg() argument 1 (data buffers) - in sock_sendmsg_iovec()
socket.recvmsg_into() argument 1 (buffers) - in sock_recvmsg_into()

Root Cause

The vulnerability occurs because:

PySequence_Fast() returns the original list object when the input is already a list (not a copy)
During iteration, PyObject_GetBuffer() triggers __buffer__ protocol callbacks which may clear the list
Subsequent iterations access invalid memory (heap OOB read), leading to a crash (SIGSEGV)

Proof of Concept

`sendmsg()` data buffers crash:

import socket

seq = []

class MutBuffer:
    def __init__(self, data):
        self._data = bytes(data)
        self.tripped = False
    
    def __buffer__(self, flags):
        if not self.tripped:
            self.tripped = True
            seq.clear()  # Clear during iteration!
        return memoryview(self._data)

seq[:] = [MutBuffer(b'Hello'), b'World', b'Test']
left, right = socket.socketpair()
left.sendmsg(seq)  # CRASH: SIGSEGV

`recvmsg_into()` buffers crash:

import socket

seq = []

class MutBuffer:
    def __init__(self, data):
        self._data = bytearray(data)
        self.tripped = False
    
    def __buffer__(self, flags):
        if not self.tripped:
            self.tripped = True
            seq.clear()  # Clear during iteration!
        return memoryview(self._data)

seq[:] = [MutBuffer(b'x' * 100), bytearray(100), bytearray(100)]
left, right = socket.socketpair()
left.send(b'Hello World!')
right.recvmsg_into(seq)  # CRASH: SIGSEGV

Fix

Replace PySequence_Fast() with PySequence_Tuple() which always creates a new tuple, ensuring the sequence cannot be mutated during iteration.

Testing

Added Lib/test/test_socket_reentrant.py with regression tests for both vulnerable code paths.

Note: This is related to but separate from PR #143892 which fixes the __index__ issue.

Issue: socket.sendmsg() and socket.recvmsg_into() crash via __buffer__ re-entrancy (related to gh-143637) #143988

bedevere-app · 2026-01-18T22:53:46Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

And if you don't make the requested changes, you will be poked with soft cushions!

tonghuaroot · 2026-01-19T02:26:33Z

I have made the requested changes; please review again.

bedevere-app · 2026-01-19T02:26:39Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

bedevere-app · 2026-01-19T02:30:59Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

picnixz · 2026-01-19T02:32:32Z

Please read the devguide:

Do not forcepush.
Do not hit the "update branch" button if there is no need to (that is, if the CI is already green for the tests). it wastes resources and notifies everyone..

…cvmsg_into via __buffer__ Fix crashes in socket.sendmsg() and socket.recvmsg_into() that could occur if buffer sequences are mutated re-entrantly during argument parsing via __buffer__ protocol callbacks. The vulnerability occurs because: 1. PySequence_Fast() returns the original list object when the input is already a list (not a copy) 2. During iteration, PyObject_GetBuffer() triggers __buffer__ callbacks which may clear the list 3. Subsequent iterations access invalid memory (heap OOB read) The fix replaces PySequence_Fast() with PySequence_Tuple() which always creates a new tuple, ensuring the sequence cannot be mutated during iteration. This addresses two vulnerabilities related to pythongh-143637: - sendmsg() argument 1 (data buffers) - via __buffer__ - recvmsg_into() argument 1 (buffers) - via __buffer__

tonghuaroot · 2026-01-19T02:47:49Z

Please read the devguide:

Do not forcepush.

Do not hit the "update branch" button if there is no need to (that is, if the CI is already green for the tests). it wastes resources and notifies everyone..

Sorry about the force pushes - I'll use regular commits going forward. Thanks for the reminder about the devguide.

tonghuaroot · 2026-01-19T02:54:33Z

I have made the requested changes; please review again.

bedevere-app · 2026-01-19T02:54:39Z

Thanks for making the requested changes!

@picnixz: please review the changes made to this pull request.

picnixz · 2026-01-19T02:59:43Z

@@ -0,0 +1,3 @@
+Fixed crashes in :meth:`socket.socket.sendmsg` and :meth:`socket.socket.recvmsg_into`
+that could occur if buffer sequences are mutated re-entrantly during argument parsing


that could occur if buffer sequences are concurrently mutated

Remove argument parsing mention. It is an implementation detail.

We do not really use the term re-entrency. I do not share the definition of re-entrency and prefer using concurrently here (you do two things at the same time)

@vstinner

@vstinner prefers the original name; revert the rename and keep the diff minimal.

@vstinner

…WS to Library - Rename sock_recvmsg_into's fast to buffers_tuple (per @vstinner). - Trim ReentrantMutationTests docstring to fit 80 columns. - This is a crash-robustness fix, not a security vulnerability; move the NEWS entry from Security/ to Library/.

tonghuaroot · 2026-06-10T12:20:48Z

Thanks @vstinner! Addressed all three:

Renamed fast to buffers_tuple in sock_recvmsg_into.
Trimmed the ReentrantMutationTests docstring to fit 80 columns.
Moved the NEWS entry from Security/ to Library/ — agreed this is a crash-robustness fix rather than a security vulnerability.

The failing Docs (pull_request) job looks unrelated to this change: it errors on a missing Doc/tools/check-html-ids.py on the runner, while this PR only touches socketmodule.c, test_socket.py, and the NEWS entry.

vstinner · 2026-06-10T12:24:03Z

@picnixz: Would you mind to review the updated PR? It seems like 2 of your comments were not addressed yet.

.

picnixz · 2026-06-10T12:29:42Z

I think the docs issue is because of the branch not being up-to-date. You can hit the "Update branch" button to merge main into this branch (just don't force push)

miss-islington-app · 2026-06-10T13:08:23Z

Thanks @tonghuaroot for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app · 2026-06-10T13:08:23Z

Thanks @tonghuaroot for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖

miss-islington-app · 2026-06-10T13:08:23Z

Thanks @tonghuaroot for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

miss-islington-app · 2026-06-10T13:08:27Z

Sorry, @tonghuaroot and @vstinner, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 896f7fdc7d0ba6d4ace06935b9d67c4da0f9ecbe 3.14

miss-islington-app · 2026-06-10T13:08:31Z

Sorry, @tonghuaroot and @vstinner, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 896f7fdc7d0ba6d4ace06935b9d67c4da0f9ecbe 3.13

bedevere-app · 2026-06-10T13:08:50Z

GH-151246 is a backport of this pull request to the 3.15 branch.

…cvmsg_into (python#143987) Fix crashes in socket.sendmsg() and socket.recvmsg_into() that could occur if buffer sequences are mutated re-entrantly during argument parsing via __buffer__ protocol callbacks. The bug occurs because: 1. PySequence_Fast() returns the original list object when the input is already a list (not a copy). 2. During iteration, PyObject_GetBuffer() triggers __buffer__ callbacks which may clear the list. 3. Subsequent iterations access invalid memory (heap OOB read). The fix replaces PySequence_Fast() with PySequence_Tuple() which always creates a new tuple, ensuring the sequence cannot be mutated during iteration. Co-authored-by: tonghuaroot <23011166+tonghuaroot@users.noreply.github.com> (cherry picked from commit 896f7fd)

bedevere-app · 2026-06-10T13:25:26Z

GH-151251 is a backport of this pull request to the 3.14 branch.

vstinner · 2026-06-10T13:26:20Z

Merged, thanks for your fix. I backport the change to 3.14 and 3.15 branches. (The 3.14 backport will be backported to 3.13 once it will be merged.)

…ecvmsg_into (#143987) (#151251) gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into (#143987) Fix crashes in socket.sendmsg() and socket.recvmsg_into() that could occur if buffer sequences are mutated re-entrantly during argument parsing via __buffer__ protocol callbacks. The bug occurs because: 1. PySequence_Fast() returns the original list object when the input is already a list (not a copy). 2. During iteration, PyObject_GetBuffer() triggers __buffer__ callbacks which may clear the list. 3. Subsequent iterations access invalid memory (heap OOB read). The fix replaces PySequence_Fast() with PySequence_Tuple() which always creates a new tuple, ensuring the sequence cannot be mutated during iteration. (cherry picked from commit 896f7fd) Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com> Co-authored-by: tonghuaroot <23011166+tonghuaroot@users.noreply.github.com>

…ecvmsg_into (GH-143987) (#151246) gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into (GH-143987) Fix crashes in socket.sendmsg() and socket.recvmsg_into() that could occur if buffer sequences are mutated re-entrantly during argument parsing via __buffer__ protocol callbacks. The bug occurs because: 1. PySequence_Fast() returns the original list object when the input is already a list (not a copy). 2. During iteration, PyObject_GetBuffer() triggers __buffer__ callbacks which may clear the list. 3. Subsequent iterations access invalid memory (heap OOB read). The fix replaces PySequence_Fast() with PySequence_Tuple() which always creates a new tuple, ensuring the sequence cannot be mutated during iteration. (cherry picked from commit 896f7fd) Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com> Co-authored-by: tonghuaroot <23011166+tonghuaroot@users.noreply.github.com>

…dmsg/recvmsg_into (#143987) (#151251) (#151256) [3.14] gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into (#143987) (#151251) gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into (#143987) Fix crashes in socket.sendmsg() and socket.recvmsg_into() that could occur if buffer sequences are mutated re-entrantly during argument parsing via __buffer__ protocol callbacks. The bug occurs because: 1. PySequence_Fast() returns the original list object when the input is already a list (not a copy). 2. During iteration, PyObject_GetBuffer() triggers __buffer__ callbacks which may clear the list. 3. Subsequent iterations access invalid memory (heap OOB read). The fix replaces PySequence_Fast() with PySequence_Tuple() which always creates a new tuple, ensuring the sequence cannot be mutated during iteration. (cherry picked from commit 896f7fd) (cherry picked from commit 632daaf) Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com> Co-authored-by: tonghuaroot <23011166+tonghuaroot@users.noreply.github.com>

bedevere-app Bot added the awaiting review label Jan 18, 2026

tonghuaroot changed the title ~~Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into via __buffer__~~ gh-143988: tation crashes in socket sendmsg/recvmsg_into via __buffer__ Jan 18, 2026

bedevere-app Bot mentioned this pull request Jan 18, 2026

socket.sendmsg() and socket.recvmsg_into() crash via __buffer__ re-entrancy (related to gh-143637) #143988

Closed

tonghuaroot force-pushed the fix-socket-reentrant-mutation branch from 333ee07 to 78c18ed Compare January 18, 2026 06:58

picnixz requested changes Jan 18, 2026

View reviewed changes

Comment thread Lib/test/test_socket_reentrant.py Outdated

bedevere-app Bot removed the awaiting review label Jan 18, 2026

bedevere-app Bot added the awaiting changes label Jan 18, 2026

tonghuaroot force-pushed the fix-socket-reentrant-mutation branch from 78c18ed to 42ad743 Compare January 19, 2026 02:21

bedevere-app Bot added awaiting change review and removed awaiting changes labels Jan 19, 2026

bedevere-app Bot requested a review from picnixz January 19, 2026 02:26

picnixz previously requested changes Jan 19, 2026

View reviewed changes

Comment thread Lib/test/test_socket.py Outdated

Comment thread Lib/test/test_socket.py Outdated

Comment thread Lib/test/test_socket.py Outdated

Comment thread Lib/test/test_socket.py

Comment thread Lib/test/test_socket.py Outdated

bedevere-app Bot added awaiting changes and removed awaiting change review labels Jan 19, 2026

tonghuaroot force-pushed the fix-socket-reentrant-mutation branch 2 times, most recently from 720a086 to 4b592ef Compare January 19, 2026 02:41

tonghuaroot force-pushed the fix-socket-reentrant-mutation branch from 4b592ef to 2c8aad6 Compare January 19, 2026 02:43

bedevere-app Bot added awaiting change review and removed awaiting changes labels Jan 19, 2026

bedevere-app Bot requested a review from picnixz January 19, 2026 02:54

picnixz reviewed Jan 19, 2026

View reviewed changes

tonghuaroot added 2 commits June 10, 2026 20:15

Keep variable name data_fast per review

74b5139

@vstinner prefers the original name; revert the rename and keep the diff minimal.

picnixz reviewed Jun 10, 2026

View reviewed changes

Comment thread Modules/socketmodule.c

Merge branch 'main' into fix-socket-reentrant-mutation

65a7b84

vstinner enabled auto-merge (squash) June 10, 2026 12:36

vstinner merged commit 896f7fd into python:main Jun 10, 2026
54 checks passed

bedevere-app Bot removed the awaiting merge label Jun 10, 2026

vstinner added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels Jun 10, 2026

miss-islington-app Bot assigned vstinner Jun 10, 2026

bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Jun 10, 2026

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Jun 10, 2026

vstinner mentioned this pull request Jun 10, 2026

[3.13][3.14] gh-143988: Fix re-entrant mutation crashes in socket sendmsg/recvmsg_into (#143987) (#151251) #151256

Merged

		@@ -0,0 +1,3 @@
		Fixed crashes in :meth:`socket.socket.sendmsg` and :meth:`socket.socket.recvmsg_into`
		that could occur if buffer sequences are mutated re-entrantly during argument parsing

Uh oh!

Conversation

tonghuaroot commented Jan 18, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root Cause

Proof of Concept

sendmsg() data buffers crash:

recvmsg_into() buffers crash:

Fix

Testing

Uh oh!

Uh oh!

bedevere-app Bot commented Jan 18, 2026

Uh oh!

tonghuaroot commented Jan 19, 2026

Uh oh!

bedevere-app Bot commented Jan 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-app Bot commented Jan 19, 2026

Uh oh!

picnixz commented Jan 19, 2026

Uh oh!

tonghuaroot commented Jan 19, 2026

Uh oh!

tonghuaroot commented Jan 19, 2026

Uh oh!

bedevere-app Bot commented Jan 19, 2026

Uh oh!

Uh oh!

Uh oh!

picnixz Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tonghuaroot commented Jun 10, 2026

Uh oh!

vstinner commented Jun 10, 2026

Uh oh!

Uh oh!

picnixz commented Jun 10, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Jun 10, 2026

Uh oh!

miss-islington-app Bot commented Jun 10, 2026

Uh oh!

miss-islington-app Bot commented Jun 10, 2026

Uh oh!

miss-islington-app Bot commented Jun 10, 2026

Uh oh!

miss-islington-app Bot commented Jun 10, 2026

Uh oh!

bedevere-app Bot commented Jun 10, 2026

Uh oh!

bedevere-app Bot commented Jun 10, 2026

Uh oh!

vstinner commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tonghuaroot commented Jan 18, 2026 •

edited by bedevere-app Bot

Loading

`sendmsg()` data buffers crash:

`recvmsg_into()` buffers crash:

picnixz Jan 19, 2026 •

edited

Loading