CVE-2024-3219 Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection
A race condition in the pure-Python socketpair fallback allows malicious local peers to hijack connections on Windows platforms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-3219?
CVE-2024-3219 is a medium-severity vulnerability in CPython, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, which leaves the server socket vulnerable to a connection race from a malicious local peer.
Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.
Weakness: CWE-306
Which versions are affected by CVE-2024-3219?
How do I fix CVE-2024-3219?
Apply the vendor's patch.
Is CVE-2024-3219 being exploited?
There is no known exploitation of CVE-2024-3219 in the wild and no public exploit code.
Sources
Also known as GHSA-r8h6-cwxj-rv5j, PSF-2024-7.