CVE-2019-18874: Double Free in psutil
Summary
CVE-2019-18874: Double Free in psutil. Affects psutil versions < 5.6.6. Fixed in 5.6.6. How to fix ↓
Also tracked for
- python-psutil · Debian:11
The same CVE-2019-18874 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
psutil (aka python-psutil) is a Python library that provides an interface for retrieving information on running processes and system utilization. It allows users to monitor various system resources such as CPU, memory, disks, network, and sensors. psutil is widely used in Python applications for system monitoring and management. However, versions up to 5.6.5 of psutil are vulnerable to a double free issue, which can lead to memory corruption and potential exploitation.
Vulnerability Detail
The vulnerability in psutil arises due to refcount mishandling within a while or for loop that converts system data into a Python object. This double free vulnerability can be exploited by an attacker to manipulate memory and potentially execute arbitrary code. The impact of this vulnerability can range from denial of service (DoS) attacks to remote code execution, depending on the attacker's capabilities and the context in which psutil is used.
How To Fix
Minimum fixed version
5.6.6
This is the first release that contains the fix.
pip install --upgrade "psutil==5.6.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of psutil is not immediately feasible, a possible workaround is to avoid using the affected functionality or to limit the exposure of the vulnerable code. However, it is strongly advised to apply the official fix by upgrading to a patched version as soon as possible.
Conclusion
The double free vulnerability in psutil can lead to memory corruption and potential exploitation. It is crucial to upgrade to the latest version of psutil (5.6.6 or later) to mitigate this vulnerability. If immediate upgrade is not possible, consider applying workarounds and limiting exposure to the vulnerable code. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for psutil →
FAQ
psutil is a Python library that provides an interface for retrieving information on running processes and system utilization. It is commonly used for system monitoring and management in Python applications.
The impact of this vulnerability can range from denial of service (DoS) attacks to remote code execution, depending on the attacker's capabilities and the context in which psutil is used.
To fix this vulnerability, it is recommended to upgrade psutil to version 5.6.6 or later. This version includes a fix for the double free issue and ensures proper handling of refcounts.
If upgrading to the latest version of psutil is not immediately feasible, a possible workaround is to avoid using the affected functionality or to limit the exposure of the vulnerable code. However, it is strongly advised to apply the official fix by upgrading to a patched version as soon as possible.
For more information about this vulnerability, you can refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/03/GHSA-qfc5-mcwq-26q8/GHSA-qfc5-mcwq-26q8.json
