CVE-2024-12254

What it actually does

The asyncio._SelectorSocketTransport.writelines() method in Python 3.12.0 and later fails to enforce backpressure by pausing writes and signaling the protocol to drain when the write buffer reaches the high-water mark, allowing unbounded buffer growth and eventual memory exhaustion on macOS and Linux.

Why it matters to the business

Affected async Python network applications may experience sudden memory exhaustion leading to service crashes or degraded performance, though impact is limited to a small subset of users relying on specific asyncio protocol and writelines patterns.

How an attack unfolds

An attacker interacts with a vulnerable Python asyncio-based server or client that uses protocols and the writelines method, sending traffic that repeatedly triggers writes without buffer draining, gradually consuming memory until the process terminates or becomes unresponsive.

How to fix it

Upgrade python/cpython to the fixed commit 71e8429ac8e2adc10084ab5ec29a62f4b6671a82 or later releases that restore proper backpressure behavior in _SelectorSocketTransport.writelines().

How to confirm the fix worked

Confirm the installed Python version is 3.12.0 or later, apply the referenced commit or subsequent release, and test that writelines pauses and signals drain at the high-water mark under load.

Typical attack path

1. Identify a target application using Python 3.12+ asyncio protocols with writelines on macOS or Linux
2. Establish a network connection to the affected transport
3. Send crafted or high-volume data that exercises writelines repeatedly
4. Observe continued buffer growth without high-water mark enforcement
5. Drive memory consumption until exhaustion and denial of service

How to detect it

Monitor for sudden or sustained increases in memory usage by Python processes using asyncio on macOS or Linux; review application logs for repeated writelines calls without corresponding drain events; correlate with network traffic volumes on affected services.

What your security team should do

• Identify and inventory Python 3.12+ deployments using asyncio protocols and writelines
• Prioritize upgrade to the fixed commit in development, staging, and production environments
• Monitor memory usage of asyncio-based services for anomalous growth patterns
• Review application code for reliance on writelines with custom protocols