cbcvebase.
CVE-2021-3177
published 2021-01-19

CVE-2021-3177: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications…

PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
18.85%
97.0th percentile
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Affected

35 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianpython2.7< python2.7 2.7.18-2 (bullseye)python2.7 2.7.18-2 (bullseye)
debianpython3.9< python2.7 2.7.18-2 (bullseye)python2.7 2.7.18-2 (bullseye)
fedoraprojectfedora
fedoraprojectfedora
msrcpython3-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm
msrcpython3-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64
msrcpython3-curses-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm
msrcpython3-curses-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64
msrcpython3-debuginfo-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm
msrcpython3-debuginfo-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64
msrcpython3-devel-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm
msrcpython3-devel-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64
msrcpython3-libs-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm
msrcpython3-libs-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64
msrcpython3-pip-3.7.9-4.cm1.noarch.rpm_on_cbl_mariner_1.0_arm
msrcpython3-pip-3.7.9-4.cm1.noarch.rpm_on_cbl_mariner_1.0_x64
msrcpython3-setuptools-3.7.9-4.cm1.noarch.rpm_on_cbl_mariner_1.0_arm
msrcpython3-setuptools-3.7.9-4.cm1.noarch.rpm_on_cbl_mariner_1.0_x64
msrcpython3-test-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm
msrcpython3-test-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64
msrcpython3-tools-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm
msrcpython3-tools-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64
msrcpython3-xml-3.7.9-4.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm
msrcpython3-xml-3.7.9-4.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64

Detection & IOCsextracted from sources · hover to see the quote

commandc_double.from_param(1e300)
path_ctypes/callproc.c
  • Trigger input is a very large floating-point value (e.g. 1e300) passed to ctypes c_double.from_param; monitor Python applications accepting untrusted floating-point input via ctypes.
  • Vulnerable code path is PyCArg_repr() in _ctypes/callproc.c; look for stack-based buffer overflow crash signatures originating from this function in Python process crash dumps or ASAN reports.
  • Applications that use ctypes without carefully validating input are the attack surface; audit Python services that accept external floating-point data and pass it to ctypes.
  • ·Red Hat packages compiled with FORTIFY_SOURCE provide runtime protection that prevents the buffer overwrite and potential code execution, reducing impact to a crash/DoS on those builds.
  • ·The Ubuntu security fix for CVE-2021-3177 in Python 2.7 was temporarily reverted due to a regression; ensure the reinstated fix (USN-4754-4) is applied rather than the intermediate reverted package.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.