CVE-2024-12254
CVE-2024-12254 is a memory exhaustion vulnerability in Python's asyncio module. Specifically, the _SelectorSocketTransport.writelines() method fails to properly pause writing when the write buffer reaches its high-water mark, leading to potential memory issues. The asyncio module in Python versions 3.12.0 and later on macOS or Linux is affected if protocols use the .writelines() method. Although rated 7.5 by CVSS, SOCRadar's SVRS of 36 indicates a lower real-world risk. This is because the vulnerability's impact requires specific conditions, including using Python 3.12+, employing asyncio with protocols, and utilizing the .writelines() method with its new zero-copy-on-write behavior. Failure to manage the write buffer can lead to resource exhaustion, potentially crashing affected applications. Ensure you apply the available patch to mitigate the vulnerability.
Description
CVE-2024-12254 is a vulnerability affecting the asyncio._SelectorSocketTransport.writelines() method in Python 3.12.0 and later. The issue arises due to the method's failure to pause writing and signal the Protocol to drain the buffer to the wire once the write buffer reaches the "high-water mark." This oversight can lead to Protocols not periodically draining the write buffer, potentially resulting in memory exhaustion.
SVRS: This CVE has an SVRS score of 36, which signifies a moderate vulnerability. While not critical, it is still important to address this issue to prevent potential memory exhaustion and performance degradation.
Key Insights
- Limited Impact: This vulnerability affects a specific subset of users using Python 3.12.0 or later on macOS or Linux with the
asynciomodule, protocols, and thewritelines()method. - Memory Exhaustion Risk: The primary impact is the potential for memory exhaustion due to the failure of Protocols to drain the write buffer.
- Zero-Copy-on-Write Behavior: The issue stems from the new zero-copy-on-write behavior introduced in Python 3.12.0 and later versions.
- Potential for Exploitation: While the vulnerability is not actively exploited in the wild, its existence could be leveraged by attackers to cause denial-of-service attacks or potentially exploit memory vulnerabilities.
Mitigation Strategies
- Upgrade Python Version: If using Python 3.12.0 or later, consider upgrading to the latest stable version, as it may include patches for this vulnerability.
- Update the
asyncioModule: If upgrading to a newer Python version is not feasible, updating theasynciomodule to the latest version may address the issue. - Implement Buffer Monitoring: Implement monitoring mechanisms to track the size of the write buffer and trigger alerts if it exceeds acceptable thresholds.
- Review and Update Protocols: Thoroughly review and update your existing protocols to ensure they handle write buffer management effectively.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.