Corrective releases of the Python programming language versions 3.7.10 and 3.6.13 are available, which address the vulnerability (CVE-2021-3177) that could lead to code execution when handling unverified floating-point numbers in handlers that call functions in the C language using the ctypes mechanism. The issue also affects Python branches 3.8 and 3.9, but updates for those are currently in candidate release status (release planned for March 1st).
The problem is caused by a buffer overflow in the ctypes function PyCArg_repr() due to unsafe use of sprintf. Specifically, a static buffer of 256 bytes ("char buffer[256]") was allocated for processing the result of the transformation 'sprintf(buffer, "", self->tag, self->value.b)', while the result could exceed this value. To check for application susceptibility to the vulnerability, you can try passing the value '1e300', which when processed by the method c_double.from_param will result in a crash, as the resulting number contains 308 characters and does not fit into the 256-byte buffer. Example problematic code: import ctypes; x = ctypes.c_double.from_param(1e300); repr(x)
The problem remains unfixed in Debian, Ubuntu, and FreeBSD, but has already been resolved in Arch Linux, Fedora, and SUSE. In RHEL, the vulnerability does not manifest due to the package assembly in FORTIFY_SOURCE mode, which prevents such buffer overflows in string functions.
Source: opennet.ru
