Vulnerability · Published Dec 6, 2024 · Assigned by PSF
CVE-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines()
High 7.5
In plain English
A high-severity uncontrolled resource consumption in CPython from Python Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | python3.12 | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12 | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-debug | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-debug | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-devel | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-devel | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-idle | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-idle | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-libs | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-libs | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-rpm-macros | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:8 | python3.12-test | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-test | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| AlmaLinux:8 | python3.12-tkinter | 3.12.8-1.el8_10 | ALSA-2024:10980 |
| AlmaLinux:9 | python3.12-tkinter | 3.12.5-2.el9_5.2 | ALSA-2024:10978 |
| Alpine:v3.20 | python3 | 3.12.8-r1 | ALPINE-CVE-2024-12254 |
| Alpine:v3.21 | python3 | 3.12.8-r1 | ALPINE-CVE-2024-12254 |
| Alpine:v3.22 | python3 | 3.12.8-r1 | ALPINE-CVE-2024-12254 |
| Alpine:v3.23 | python3 | 3.12.8-r1 | ALPINE-CVE-2024-12254 |
| Alpine:v3.24 | python3 | 3.12.8-r1 | ALPINE-CVE-2024-12254 |
| Debian:13 | python3.13 | 3.13.1-2 | DEBIAN-CVE-2024-12254 |
| Rocky Linux:8 | python3.12 | 0:3.12.8-1.el8_10 | RLSA-2024:10980 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.4 | UBUNTU-CVE-2024-12254 |
| Ubuntu:24.04:LTS | python3.12 | 3.12.3-1ubuntu0.4 | USN-7219-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Python Software Foundation | CPython | 0 – before 3.12.93.13.0 – before 3.13.23.14.0a1 – before 3.14.0a3 |
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/python/cpython/issues/127655 issue-tracking
- https://github.com/python/cpython/pull/127656 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB/ vendor-advisory
- https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82 patch
- https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5 patch
- https://github.com/python/cpython/commit/e991ac8f2037d78140e417cc9a9486223eb3e786 patch
- http://www.openwall.com/lists/oss-security/2024/12/06/1
- https://security.netapp.com/advisory/ntap-20250404-0010/