Repository navigation
_hashlib: Use-After-Free + Double Free in _hashopenssl.c py_hashentry_table_new() #145301
Description
Crash report
What happened?
In py_hashentry_table_new(), when _Py_hashtable_set() fails for an alias key (line 270), entry is explicitly freed via PyMem_Free(entry) at line 271. However, this same entry was already successfully inserted into the hashtable under py_name at line 263. The goto error path then calls _Py_hashtable_destroy(ht) (line 280), which invokes the destroy callback py_hashentry_t_destroy_value() on the already-freed entry.
// Modules/_hashopenssl.c - py_hashentry_table_new()
for (const py_hashentry_t *h = py_hashes; h->py_name != NULL; h++) {
py_hashentry_t *entry = (py_hashentry_t *)PyMem_Malloc(sizeof(py_hashentry_t));
if (entry == NULL) {
goto error;
}
memcpy(entry, h, sizeof(py_hashentry_t));
// [line 263] entry inserted into hashtable under py_name - hashtable now owns it
if (_Py_hashtable_set(ht, (const void*)entry->py_name, (void*)entry) < 0) {
PyMem_Free(entry);
goto error;
}
entry->refcnt = 1;
if (h->py_alias != NULL) {
// [line 270] second insert fails (e.g. OOM)
if (_Py_hashtable_set(ht, (const void*)entry->py_alias, (void*)entry) < 0) {
PyMem_Free(entry); // [line 271] BUG: entry freed, but still in hashtable under py_name
goto error; // [line 272] jumps to error path
}
entry->refcnt++;
}
}
return ht;
error:
_Py_hashtable_destroy(ht); // [line 280] destroy callback called on already-freed entry
return NULL;Build
mkdir build-asan && cd build-asan
../configure --with-pydebug --with-address-sanitizer --without-pymalloc
make -j$(nproc)import subprocess
import sys
code = (
"import sys, _testcapi\n"
"if '_hashlib' in sys.modules:\n"
" del sys.modules['_hashlib']\n"
"_testcapi.set_nomemory(40, 41)\n"
"try:\n"
" import _hashlib\n"
"except (MemoryError, ImportError):\n"
" pass\n"
"finally:\n"
" _testcapi.remove_mem_hooks()\n"
)
result = subprocess.run(
[sys.executable, '-c', code],
capture_output=True, text=True, timeout=10
)
if result.returncode != 0:
print(f"[*] CRASH confirmed (rc={result.returncode})")
print(f"[*] {result.stderr.strip().split(chr(10))[-1]}")
else:
print("[*] No crash (try different start values)")$ ./build-asan/python uaf_asan.py
[*] CRASH confirmed (rc=-6)
[*] python: ../Include/internal/pycore_stackref.h:554: PyStackRef_FromPyObjectSteal: Assertion `obj != NULL' failed.GDB backtrace
$ gdb -batch -ex run -ex bt --args ./build-asan/python -c "
import sys, _testcapi
if '_hashlib' in sys.modules:
del sys.modules['_hashlib']
_testcapi.set_nomemory(40, 41)
try:
import _hashlib
except (MemoryError, ImportError):
pass
finally:
_testcapi.remove_mem_hooks()
"python: ../Include/internal/pycore_stackref.h:554: PyStackRef_FromPyObjectSteal: Assertion `obj != NULL' failed.
Program received signal SIGABRT, Aborted.
#0 __pthread_kill_implementation at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill at ./nptl/pthread_kill.c:89
#3 __GI_raise at ../sysdeps/posix/raise.c:26
#4 __GI_abort at ./stdlib/abort.c:79
#5 __assert_fail_base — Assertion `obj != NULL' failed.
#6 __assert_fail at ./assert/assert.c:105
#7 PyStackRef_FromPyObjectSteal at ../Include/internal/pycore_stackref.h:554
#8 _PyEval_EvalFrameDefault at ../Python/generated_cases.c.h:292
...
#15 import_find_and_load — importing _hashlib
...
#19 _PyEval_EvalFrameDefault at ../Python/generated_cases.c.h:6424
The assertion fires because memory corruption during _hashlib module init (caused by the UAF/double-free) propagates a NULL into the eval loop.
Suggested Fix
Remove PyMem_Free(entry) at line 271. The entry is already owned by the hashtable (under py_name with refcnt=1), so _Py_hashtable_destroy() in the error path will correctly clean it up via the destroy callback.
if (h->py_alias != NULL) {
if (_Py_hashtable_set(ht, (const void*)entry->py_alias, (void*)entry) < 0) {
- PyMem_Free(entry);
goto error;
}
entry->refcnt++;
}CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Output from running 'python -VV' on the command line:
Python 3.15.0a6+
Activity
[-]Use-After-Free + Double Free in `_hashopenssl.c` `py_hashentry_table_new()`[/-][+]`_hashlib`: Use-After-Free + Double Free in `_hashopenssl.c` `py_hashentry_table_new()`[/+]sergey-miryanov commentedon Feb 27, 2026
Would you like to make a PR?
raminfp commentedon Feb 27, 2026
Thanks for offering. If possible, I’d appreciate it if you could create the PR. Thank you!
sergey-miryanov commentedon Feb 27, 2026
Thanks! It looks like an easy task. I will add such label.
gh-145301: Fix double-free in hashlib and hmac module initialization (G…
pythongh-145301: Fix double-free in hashlib and hmac module initializ…
[3.14] gh-145301: Fix double-free in hashlib and hmac module initiali…
sergey-miryanov commentedon Mar 5, 2026
@raminfp Thanks for the report and @krylosov-aa for the fix!
sergey-miryanov commentedon Mar 5, 2026
Reopen as 3.13 not backported.
[3.13] gh-145301: Fix double-free in hashlib initialization (GH-145321)…
sergey-miryanov commentedon Mar 10, 2026
Thanks all, now closing.
pythongh-145301: Fix double-free in hashlib and hmac module initializ…