Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.

N/A

栈缓冲区溢出

CPython 安全漏洞

CPython是Python基金会的一个用C语言实现的Python解释器。 cpython存在安全漏洞，该漏洞源于profiling.sampling模块和asyncio自省功能，可能导致读取和写入特权进程中的地址。

N/A

N/A