Listen to this Post
How the CVE Works
The vulnerability in pycares arises due to improper handling of callback references during garbage collection of a `Channel` object. When DNS queries are pending, `ffi.new_handle()` stores callback references. If the `Channel` object is garbage collected before query completion, these references become invalid. When c-ares attempts to invoke the callback, it accesses freed memory, triggering a fatal Python error. The race condition occurs between Python’s garbage collector and c-ares’s callback execution—__del__ cannot safely call `ares_destroy()` while c-ares is still processing post-callback cleanup. This leads to interpreter crashes, especially when `event_thread=True` or under rapid query failures.
DailyCVE Form
Platform: pycares
Version: <4.9.0
Vulnerability: Use-after-free
Severity: Critical
Date: 2023-08-10
Prediction: Patch expected by 2023-08-15
What Undercode Say
Crash trigger example
import pycares
channel = pycares.Channel()
channel.query("example.com", pycares.QUERY_TYPE_A)
del channel Forces garbage collection
How Exploit
- Rapidly trigger DNS queries.
- Force premature `Channel` garbage collection.
- Crash interpreter via freed memory access.
Protection from this CVE
- Upgrade to pycares ≥4.9.0.
- Use explicit
channel.close(). - Prefer long-lived `Channel` instances.
Impact
- Remote interpreter crash.
- Denial-of-service (DoS).
- Affects per-request `Channel` usage.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
