Use After Free Affecting scipy package, versions [,1.8.0)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.16% (54th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-SCIPY-5759266
- published 7 Jul 2023
- disclosed 7 Jul 2023
- credit Ella Ma
Introduced: 7 Jul 2023
CVE-2023-29824 Open this link in a new tabHow to fix?
Upgrade scipy to version 1.8.0 or higher.
Overview
Affected versions of this package are vulnerable to Use After Free via the Py_FindObjects() function.
Note:
According to the maintainer, this issue is not to be considered a vulnerability.
PoC
void f() {
PyObject *result = PyList_New(1); // <-- new reference returned (line 878)
assert(result);
printf("%ld\n", result->ob_refcnt); // 1
PyErr_NoMemory(); // <-- error happens, an exception is thrown (line 890)
Py_XDECREF(result); // <-- destruction here (line 924)
printf("%ld\n", result->ob_refcnt); // 0
if (PyErr_Occurred()) {
Py_XDECREF(result); // <-- use after free here (line 931)
printf("%ld\n", result->ob_refcnt); // -1
}
}
References
CVSS Scores
version 3.1