Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
The error occurs when memory allocation fails during decompression, resulting in a `MemoryError` exception, and then the same decompressor instance is reused for another decompression operation. In this case, the pointer to the freed memory area (dangling pointer) is not cleaned up, leading to a use-after-free condition. The vulnerability does not affect one-time helper functions (`lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, `zlib.decompress()`), since each call creates a new decompressor instance. The fix removes the dangling pointer when the described error occurs.
An attacker who can influence the processed data and provoke appropriate memory conditions can cause unauthorized read or write access to the process memory, potentially resulting in disclosure of sensitive data or arbitrary code execution (RCE).
Apply patches available in the CPython repository according to references (commits: 47128e6, 6a5f79c, 8fc66ae, c3cf71c, e20c6c9). It is recommended to update the Python environment to a version containing the fix. As a temporary measure, ensure that the application code does not reuse decompressor instances after a `MemoryError` exception occurs, or use only one-time helper functions (`lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, `zlib.decompress()`).
Python applications that reuse instances of `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, or `gzip.GzipFile` classes after a `MemoryError` exception occurs during decompression; specific vulnerable CPython versions are indicated in vendor references (commits on GitHub python/cpython)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X