CVE-2021-3177: Buffer Overflow
A flaw was found in python. A stack-based buffer overflow was discovered in the ctypes module provided within Python. Applications that use ctypes without carefully validating the input passed to it may be vulnerable to this flaw, which would allow an attacker to overflow a buffer on the stack and crash the application. The highest threat from this vulnerability is to system availability.
Other sources
Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to cdouble.fromparam. This occurs because sprintf is used unsafely.
Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input.
Reference:
https://bugs.python.org/issue42938 https://github.com/python/cpython/pull/24239
— Red Hat
Python is vulnerable to a buffer overflow, caused by improper bounds checking by the PyCArgrepr function in ctypes/callproc.c. By sending specially-crafted arguments to cdouble.fromparam, a remote attacker could overflow a buffer and execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3177?
CVE-2021-3177 is a vulnerability in Python that allows an attacker to overflow a buffer on the stack and potentially execute arbitrary code.
What is the severity of CVE-2021-3177?
The severity of CVE-2021-3177 is critical with a CVSS score of 9.8.
Which versions of Python are affected by CVE-2021-3177?
Python versions 2.7.0 to 2.7.18, 3.6.0 to 3.6.12, 3.7.0 to 3.7.9, 3.8.0 to 3.8.7, and 3.9.0 to 3.9.1 are affected by CVE-2021-3177.
How can I fix CVE-2021-3177?
To fix CVE-2021-3177, upgrade to Python versions 2.7.19, 3.6.13, 3.7.10, 3.8.8, or 3.9.2 or later.
Are there any references for CVE-2021-3177?
Yes, you can find more information about CVE-2021-3177 at the following references: [Link 1](https://bugs.python.org/issue42938), [Link 2](https://github.com/python/cpython/pull/24239), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1918175).