On February 27th, 2018, the Python Security Response team was notified of a buffer overflow issue in the os.symlink() method on Windows. The issue affects all versions of Python between 3.2 and 3.6.4, including the 3.7 beta releases. It will be patched for the next releases of 3.4, 3.5, 3.6 and 3.7.

Scripts may be vulnerable if they use os.symlink() on Windows and an attacker is able to influence the location where links are created. As os.symlink requires administrative privileges on most versions of Windows, exploits using this vulnerability are likely to achieve escalation of privilege.

Besides applying the fix to CPython, scripts can also ensure that the length of each path argument is less than 260, and if the source is a relative path, that its combination with the destination is also shorter than 260 characters. That is:

assert (len(src) < 260 and
        len(dest) < 260 and
        len(os.path.join(os.path.dirname(dest), src)) < 260)
os.symlink(src, dest)

Scripts that explicitly pass the target_is_directory argument as True are not vulnerable. Also, scripts on Python 3.5 that use bytes for paths are not vulnerable, because of a combination of stack layout and added parameter validation.

I will be requesting a CVE for this once the patches are applied to maintenance branches, and then notifying the security-announce list. The patch has been reviewed by the PSRT and reporter, and while it prevents the buffer overflow, it does not raise any new errors or enable the use of long paths when creating symlinks.

Many thanks to Alexey Izbyshev for the report, and helping us work through developing the patch.

While judging by the source code it seems that bytes in 3.5 should be fine, I've got a crash with the latest binary from python.org:

Python 3.5.4 (v3.5.4:3f56838, Aug  8 2017, 02:17:05) [MSC v.1900 64 bit (AMD64)]
 on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import os
>>> os.symlink(b'x\\' * 129, b'y\\' * 129)
(Windows pop-up here)

As os.symlink requires administrative privileges on most versions of Windows

The current implementation requires SeCreateSymbolicLinkPrivilege on ALL versions of Windows because users must pass an additional flag to CreateSymbolicLink to enable non-privileged symlinks on recent Windows 10, which os.symlink() doesn't do (see bpo-31512).

> As os.symlink requires administrative privileges on most versions
> of Windows

The current implementation requires SeCreateSymbolicLinkPrivilege on
ALL versions of Windows because users must pass an additional flag to
CreateSymbolicLink to enable non-privileged symlinks on recent Windows
10, which os.symlink() doesn't do (see bpo-31512).

The change in Windows 10 to allow unprivileged creation of links will be supported implicitly in 3.7, but this change is more for convenience than necessity. SeCreateSymbolicLinkPrivilege can be granted to standard users and groups. On my own systems, I grant this privilege to the "Authenticated Users" (S-1-5-11) well-known group. This even allows administrators to create symbolic links without having to elevate.

New changeset 6921e73 by Steve Dower in branch 'master':
bpo-33001: Prevent buffer overrun in os.symlink (GH-5989)
6921e73

New changeset baa4507 by Steve Dower in branch '3.6':
[3.6] bpo-33001: Prevent buffer overrun in os.symlink (GH-5989) (GH-5990)
baa4507

Patches are merged, except for the ones that belong to @larry.

Thanks again Alexey for the final round of feedback!

New changeset 96fdbac by Miss Islington (bot) in branch '3.7':
bpo-33001: Prevent buffer overrun in os.symlink (GH-5989)
96fdbac

FYI, the CVE number for this issue is CVE-2018-1000117.

FYI I added this vulnerability to:
http://python-security.readthedocs.io/vuln/cve-2018-1000117_buffer_overflow_vulnerability_in_os.symlink_on_windows.html
vstinner/python-security@349588e

Thanks, Victor!

New changeset 77c02cd by larryhastings (Steve Dower) in branch '3.4':
[3.4] bpo-33001: Prevent buffer overrun in os.symlink (GH-5989) (bpo-5992)
77c02cd

New changeset f381cfe by larryhastings (Steve Dower) in branch '3.5':
[3.5] bpo-33001: Prevent buffer overrun in os.symlink (GH-5989) (bpo-5991)
f381cfe

Thanks Larry for merging the backports!