Segfault calling: `SSLObject.group()` before a session has been established

[stestagg]

Crash report

What happened?

Python 3.16.0a0 (heads/main-dirty:716cbae, Aug 13 2026, 11:31:04) [Clang 22.1.8 ] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
...
... context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
... ssl_object = context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO())
... print(ssl_object.group())
...
Segmentation fault

Here's the script:

import ssl

context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ssl_object = context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO())
print(ssl_object.group())

LLDB Stack

(lldb) run
Process 92 launched: '/pfm/py/bin/python3' (aarch64)
Process 92 stopped
* thread #1, name = 'python3', stop reason = signal SIGSEGV: address not mapped to object (fault address=0x308)
    frame #0: 0x0000fffff77c4e1c libssl.so.3`SSL_get0_group_name + 156
libssl.so.3`SSL_get0_group_name:
->  0xfffff77c4e1c <+156>: ldr    w1, [x0, #0x308]
    0xfffff77c4e20 <+160>: ldr    x0, [x2, #0x8]
    0xfffff77c4e24 <+164>: adrp   x16, 235
    0xfffff77c4e28 <+168>: ldr    x16, [x16, #0x670]
(lldb) bt
* thread #1, name = 'python3', stop reason = signal SIGSEGV: address not mapped to object (fault address=0x308)
  * frame #0: 0x0000fffff77c4e1c libssl.so.3`SSL_get0_group_name + 156
    frame #1: 0x0000fffff7903fc0 _ssl.cpython-316d-aarch64-linux-gnu.so`_ssl__SSLSocket_group_impl(self=0x0000fffff7a59b70) at _ssl.c:2230:18 [inlined]
    frame #2: 0x0000fffff7903fac _ssl.cpython-316d-aarch64-linux-gnu.so`_ssl__SSLSocket_group(self=0x0000fffff7a59b70, _unused_ignored=0x0000000000000000) at _ssl.c.h:219:20
    frame #3: 0x0000aaaaaaedb49c python3`method_vectorcall_NOARGS(func=0x0000fffff7a098b0, args=0x0000ffffffffcc40, nargsf=9223372036854775809, kwnames=0x0000000000000000) at descrobject.c:448:24
    frame #4: 0x0000aaaaaaeb0b64 python3`_PyObject_VectorcallTstate(tstate=0x0000aaaaab7f98e0, callable=0x0000fffff7a098b0, args=0x0000ffffffffcc40, nargsf=9223372036854775809, kwnames=0x0000000000000000) at pycore_call.h:144:11
    frame #5: 0x0000aaaaab2d7d64 python3`PyObject_Vectorcall(callable=<unavailable>, args=0x0000ffffffffcc40, nargsf=<unavailable>, kwnames=0x0000000000000000) at call.c:327:12 [inlined]
    frame #6: 0x0000aaaaab2d7d54 python3`_Py_VectorCallInstrumentation_StackRefSteal(callable=<unavailable>, arguments=0x0000fffff7fe90f8, total_args=<unavailable>, kwnames=(bits = 1), call_instrumentation=false, frame=0x0000fffff7fe9098, this_instr=0x0000fffff7adb3d6, tstate=0x0000aaaaab7f98e0) at ceval.c:768:11
    frame #7: 0x0000aaaaab28436c python3`_PyEval_EvalFrameDefault(tstate=<unavailable>, frame=<unavailable>, throwflag=<unavailable>) at generated_cases.c.h:1906:35
    frame #8: 0x0000aaaaab270f54 python3`_PyEval_EvalFrame(tstate=0x0000aaaaab7f98e0, frame=0x0000fffff7fe9020, throwflag=0) at pycore_ceval.h:122:16 [inlined]
    frame #9: 0x0000aaaaab270f2c python3`_PyEval_Vector(tstate=<unavailable>, func=<unavailable>, locals=0x0000fffff7acd610, args=<unavailable>, argcount=<unavailable>, kwnames=0x0000000000000000) at ceval.c:2172:12
    frame #10: 0x0000aaaaab2708f0 python3`PyEval_EvalCode(co=0x0000fffff7c95a80, globals=0x0000fffff7acd610, locals=0x0000fffff7acd610) at ceval.c:679:21

Python side call site:

cpython/Modules/_ssl.c

Lines 2227 to 2230 in 5d91cf6

	if (self->ssl == NULL) {
	Py_RETURN_NONE;
	}
	group_name = SSL_get0_group_name(self->ssl);

This looks pretty much like an OpenSSL bug.

The openssl docs say:

If SSL_get0_group_name() returns NULL, an error occurred; possibly no TLS session has been established

strongly implying that we should get NULL return rather than a null dereference.

There's a fix been added to pyopenssl:
pyca/pyopenssl#1442 (comment)

And I've just raised an openssl bug:
openssl/openssl#32379

The intended behaviour is in the PR review comments:

What happens if the handshake hasn't been initiated or completed yet? If this returns NULL in that case, it would be good to mention it.

Good point, I'm not actually sure if it would return NULL or just break. I will make sure it returns NULL and update the doc to reflect it.

The Python function was introduced by:

commit 377b78761814e7d848361e642d376881739d5a29
Author: Ron Frederick <ronf@timeheart.net>
Date:   Mon Jul 28 10:33:31 2025 -0700

    gh-136306: Add support for getting and setting SSL groups (#136307)

tagging: @ronf

This issue has been in openssl 3.2 up to master.

While this is really an upstream issue, it seems reasonable to consider a python level fix, the conditions for this happening are quite easy to detect, and it means that python has a fix immediately?

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (heads/main-dirty:716cbae, Aug 13 2026, 11:31:04) [Clang 22.1.8 ]

[picnixz]

Yes, we should prevent this issue. Hopefully, it should only be in Python 3.15+ but ... let's fix that by using this "check if a session exists" first. I believe we can keep the fix around as it's not really a costly operation

[picnixz]

Not really a release blocker as the fix is fairly simple and can get into the RC quite fast. I will take care of it tomorrow or if someone beats me to it, they can. But I don't want an AI doing this job. When it comes to security, I want a proper human I can talk to.

[stestagg]

I'm not super keen to touch this. Looking at the openssl code, there's a couple of branches, and it would take a while to work out which of those might impact this here:

https://github.com/openssl/openssl/blob/d9f5cb8965cb56414b97a95a101dc68e08f26476/ssl/s3_lib.c#L5659-L5668

I'm guessing sc would never be null in our case (?), but is a TLS1.3 connection after key exchange something where it would be valid for session to be null?