gh-125984: fix UAF on fut->fut_{callback,context}0 due to an evil loop.__getattribute__

[picnixz]

Minimal PoCs:

importasyncioclassEvilLoop:
defcall_soon(self, *args, **kwargs):
print(1) # crashes just after printingdefget_debug(self):
returnFalsedef__getattribute__(self, name):
globaltrackerifname=="call_soon":
fut.remove_done_callback(tracker)
deltrackerreturnobject.__getattribute__(self, name)
fut=asyncio.Future(loop=EvilLoop())
tracker=lambda: ...
fut.add_done_callback(tracker)
fut.set_result("boom")

and

importasyncioclassEvilLoop:
defcall_soon(self, *args, **kwargs):
raiseException("unreachable")
defget_debug(self):
returnFalsedef__getattribute__(self, name):
ifname=="call_soon":
x=lambda: ...
x.get_debug=lambda: Falsefut.__init__(loop=x)
returnobject.__getattribute__(self, name)
fut=asyncio.Future(loop=EvilLoop())
cb, ctx=lambda: ..., lambda: ...
fut.add_done_callback(cb, context=ctx)
delcb, ctxfut.set_result("kaboom")

Note that depending on how the PoC is written, the crash may happen at interpreter shutdown instead. The above PoCs are a bit different from the original ones and from the ones in the tests though, but I've confirmed that without the ownership transfer, all PoCs crash.

cc @Nico-Posada

• Issue: UAF on fut->fut_{callback,context}0 with evil __getattribute__ in _asynciomodule.c #125984

[miss-islington-app]

Thanks @picnixz for the PR, and @kumaraditya303 for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13.
🐍🍒⛏🤖

[bedevere-app]

GH-126043 is a backport of this pull request to the 3.13 branch.

[bedevere-app]

GH-126044 is a backport of this pull request to the 3.12 branch.