CVE-2024-3220

What it actually does

The mimetypes module in CPython uses default file locations (such as C:\etc\mime.types) that are writable by unprivileged users on Windows; attackers can place invalid content there to trigger MemoryError during Python interpreter startup or cause file extensions to be mapped to the wrong MIME type.

Why it matters to the business

Python applications and services on Windows may experience unexpected startup failures or incorrect file-type handling, leading to application crashes, disrupted workflows, and potential data-processing errors; urgency is low given stable EPSS and no KEV listing.

How an attack unfolds

An attacker with local access on a Windows system creates or overwrites a file at one of the default writable paths used by mimetypes, supplies malformed MIME data, then waits for any Python process to start and load the module, resulting in a MemoryError or misclassified file types.

How to fix it

Call mimetypes.init([]) at application startup on Windows to bypass default locations; upgrade affected packages to the listed fixed versions (linux-6.1 to 6.1.159-1~deb11u1, linux to 6.17.8-1) where applicable and verify the change in subsequent releases.

How to confirm the fix worked

Confirm mimetypes.init is invoked with an empty list on Windows, verify absence of default writable paths in Python startup logs, and test that startup no longer raises MemoryError when the crafted file is present.

Typical attack path

1. Locate or create a writable default mime.types path on Windows
2. Write invalid or attacker-controlled MIME mapping data into the file
3. Trigger startup of any Python process that imports mimetypes
4. Observe MemoryError or incorrect file-type interpretation

How to detect it

Review Python process startup logs for MemoryError entries, inspect C:\etc and similar default paths for unexpected mime.types files, and correlate with any recent file-creation events in those directories.

What your security team should do

• Apply the provided fixed package versions immediately on Debian systems
• Add mimetypes.init([]) workaround to all Windows Python entry points
• Monitor EPSS and KEV status for any future increase in exploit activity
• Audit Python startup code for reliance on default MIME locations