{"id":"PSF-2018-2","summary":"Python 2.7 readahead is not thread safe","details":"Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3-\u003eMalloc-\u003eThread1-\u003eFree's-\u003eThread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.","aliases":["CVE-2018-1000030"],"modified":"2026-05-18T23:09:58.107300Z","published":"2018-02-08T17:00:00Z","database_specific":{"cwe_ids":[]},"references":[{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/cve-2018-1000030"},{"type":"REPORT","url":"https://bugs.python.org/issue31530"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"0"},{"fixed":"dbf52e02f18dac6f5f0a64f78932f3dc6efc056b"}]}],"versions":["v2.7.13rc1","v2.7.12rc1","v2.7.11rc1","v2.7.10rc1","v2.7.9rc1","v2.7.8","v2.7.6rc1","v2.7.5","v2.7.4rc1","v2.7.3rc1","v2.7.2rc1","v2.7","v2.7.1","v2.7.1rc1","v2.7rc2","v2.7rc1","v2.7b2","v2.7b1","v2.7a4","v2.7a3","v2.7a2","v2.7a1","v2.6","v2.6rc2","v2.6rc1","v2.6b3","v2.6b2","v2.6b1","v2.6a3","v2.6a2","v2.6a1","v2.5b3","v2.5b2","v2.5b1","v2.5a2","v2.5a1","v2.5a0","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2018-2.json","vanir_signatures_modified":"2026-05-18T23:09:58Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b","target":{"file":"Objects/fileobject.c"},"deprecated":false,"digest":{"line_hashes":["323543115282939855335627781104736550655","123742463445805796580442705404907079679","202816757465683637633440828692147533962","184643843703879312431626236860159007576","261907143414595581068627280275627726470","158700292985958317076457455599972852186","11133040543889074775166701287322774622","206196018956521294341621139107162734223","258008840679493368401860072185665047648","158912025914019037714530482644188295955","118397333679176662679091911608283280188","318013449774955445047936724426302612012","34711568872535288210473113961271772291","89674761934528476661792634480810536635","154175948685301511741557774476058693276","145652323950257575435848658785551004139","212543404993786952114018856636444145431","217083153076009549754542300420306477956","197635936743591306388077955471938603702","65022073363405100203006500825656534340","53432988100559648104096544295690405213","243373762099040107108891551979862480211","63639112030521365300530531963098350874","203687335748945943425494444525578288633","222131502876036855138909508916569830606","183244489349433250317300329819015508150","245482094097972397741807538647600197968","312281367845805122394661907061627293128","150428200689309013823259672032444523773","211008218391529950244962955577572821320","129231508069497860068283493283289769855","10094250209465030514615393933702668490","316863664070254806091059426194378674286","305590346159099807840926463596945009626","137598507701532014680792927862689023184","145649260287876754307474821958793959220","246501656905204529807944861841466505739","168494494702021012242274088564870605507","149588156586333106944220519325715280458","174725052039379418586093953717432796015","332088892115627133206442641735201519116","24605427968584248231893514233706837412","258571740082102543567799992098616276079","45179289304203293450353186804558685104","321015503989240293823231790891645317716","240273111711418215926025779201651690129","102378847949843245644659363483076310391","120170274130484966960105921875177474071","230016349326511101168610878373103130569","325348214856800574555563561018366024963","166158519228148420028334152815754853466","283562493685890587498305939065731730611","339868224326905846025620499701299696557","253982512549272344924364363125182640073","224570718897906043207980857067022280654","27786715777652055291299461120899458362","280347238258784997624107472354938325338","302550940502737299727203062530843105946","74740079308833782841998915332235042275","158358004514052623079963909820203384266","321697133738963991706883411839552487767","122720314619016432383330180496779367171","239597304100106612533491931386554367373","71553562197047645737388942357165412167","37741137503595965615791996165228671499","253020882204845010202172065873179527896","298220692976263406276238790250307973959","193898440642750129825097718009360847281","205198062765309416356206791379613898039","248115737368821907468899809286965778151","1773655962654771942491362996627829893","253588061639358237052883682316258075062","304454315367309429290412910443141639315","60754734568097475390652323990511141177","170237677888839855456502562858110890933","45011136378799885890402838565626095351","13689286819447029559221521317312400642","243593717938737988808566047149163716809","110720415229777877389404705042964497853","279887957875546660686113687429570201132","160788811190649795991226949347507962610","274927131745526808311115407037500339584","49196842707442615675453290699589347419","27200494530742855321317319757951236879","217637357010082137005043068841442211146","332083121281462843179339614116592700301","57971750784471721151396787928521357782","166495590613952545852154182416606198275","210428338606929506835056621613315853965","165809872704106561889223141891731077923","212058077957985126061056422146858411245","219559302974481898678714551150824969860","168968943076640108634641492971215640602","64455170317011002261501593532365994918","176035767951174638308991985415517261324","243901256298969333007463169275905300752","279148721690009403826045118746750536929","93669838124201675629879004157213044082","149940277223128915758291431555855257384","280171645607347755321596846935917753772","292138990023438447969892331803919594191","5932922897700951124494516515979100348","114826440092178776407085257671512649625","313685864265228648164704047395004926252","53758617776720036208126214344712774541","317317971753040403069503834397883122006","221855449822216919995962101159512537334","32088705879463732391842111460683338929","313659881200708513576514287366489280759"],"threshold":0.9},"id":"PSF-2018-2-530d6be7"},{"id":"PSF-2018-2-56ff38a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b","target":{"function":"file_seek","file":"Objects/fileobject.c"},"deprecated":false,"digest":{"length":1169,"function_hash":"269485302226630615120407486640244123781"}},{"source":"https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b","target":{"function":"readahead_get_line_skip","file":"Objects/fileobject.c"},"deprecated":false,"digest":{"function_hash":"46426356841523651039271937818992643129","length":1176},"id":"PSF-2018-2-5e512db6","signature_type":"Function","signature_version":"v1"},{"id":"PSF-2018-2-6ad7e29a","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b","target":{"file":"Objects/fileobject.c","function":"file_iternext"},"deprecated":false,"digest":{"function_hash":"172007661186988687030094743099575326409","length":326}},{"deprecated":false,"digest":{"function_hash":"215014135469086011398598779954149897954","length":738},"id":"PSF-2018-2-aa66de54","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b","target":{"file":"Objects/fileobject.c","function":"readahead"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/dbf52e02f18dac6f5f0a64f78932f3dc6efc056b","target":{"function":"drop_readahead","file":"Objects/fileobject.c"},"deprecated":false,"digest":{"function_hash":"45923269405873619774525886874692278713","length":131},"id":"PSF-2018-2-c2f9ea64"}]}}],"schema_version":"1.7.5"}