PT-2024-39977 · Pypi · Pyo3

Published 2024-10-12 · Updated 2025-01-27 · CVE-2024-9979

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PyO3 versions prior to 0.22.4 PyO3 version 0.22.4 (with mitigated functions, to be fully removed in 0.23)

Description A flaw was found in PyO3, causing a use-after-free issue. This can lead to memory corruption or crashes through unsound borrowing from weak Python references. The issue arises because the weak reference does not have ownership of the value, and the last strong reference could be cleared at any point, making the borrowed value dangling.

Recommendations For PyO3 versions prior to 0.22.4, update to version 0.22.4 to leverage the mitigated functions. For PyO3 version 0.22.4, consider avoiding the use of deprecated functions that read "borrowed" values from Python weak references until they are fully removed in version 0.23. For all affected versions, await the release of PyO3 0.23, which will remove the problematic functions entirely.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2024-9979

GHSA-6JGW-RGMM-7CV6

RUSTSEC-2024-0378

Affected Products

Pyo3

References · 18

• https://osv.dev/vulnerability/RUSTSEC-2024-0378 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-9979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9979 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-9979 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-9979 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-9979 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6jgw-rgmm-7cv6 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-9979 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-9979 · Vendor Advisory
• https://github.com/PyO3/pyo3/pull/4590 · Note
• https://github.com/PyO3/pyo3 · Note
• https://access.redhat.com/security/cve/CVE-2024-9979 · Note
• https://twitter.com/VulmonFeeds/status/1846265647266681056 · Twitter Post
• https://t.me/cvedetector/7922 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2318646 · Note