Double Free in Django (Python)

A double free occurs when memory that has already been deallocated is freed again, leading to undefined behavior that can be exploited to crash the application or execute arbitrary code. In Django applications written in Python, this vulnerability typically surfaces when custom C extensions, third-party packages, or the Django ORM interact with Python's memory management in ways that bypass proper reference counting.

Python uses reference counting as the primary mechanism for memory management, supplemented by a cyclic garbage collector. When a Django view or model manager creates an object and then reassigns or deletes references without ensuring the object is no longer referenced elsewhere, the reference count may drop to zero prematurely. If a subsequent code path attempts to free the same memory again—perhaps through a different reference or via a custom C extension—Python's internal allocator can raise a RuntimeError: double free detected or, in more severe cases, allow corruption that enables code injection.

In Django, the ORM's queryset caching and signal handling can inadvertently create such scenarios. For example, calling Model.objects.filter(...).delete() inside a signal handler that is also triggered by the deletion of related objects can cause the same model instance to be deleted twice. This pattern is particularly dangerous when combined with custom middleware that holds references to model instances beyond their expected lifecycle.

Real-world exploitation of double free in Python often involves manipulating the interpreter's object lifecycle. An attacker who can influence input that reaches a vulnerable view may force the application to reuse a freed object's memory for attacker-controlled data. Because Python's memory allocator reuses freed blocks, the attacker can potentially overwrite function pointers or vtables, leading to arbitrary code execution. This is not a theoretical risk; CVE-2020-13934 affected a popular Django package where improper handling of session data led to a double free condition when sessions were serialized and deserialized concurrently.

Detection of double free vulnerabilities relies on runtime checks provided by Python's debug builds and tools like valgrind or AddressSanitizer. Enabling PYTHONMALLOC=debug or running the application under PYTHONFAULTHANDLER=1 can surface detailed stack traces when a double free occurs. Django's test suite includes assertions that catch double free conditions in development environments, but production deployments must rely on external profilers or careful code review to identify unsafe reference patterns.

Best practices to mitigate double free risks include avoiding long-lived references to model instances, using weak references where appropriate, and ensuring that signal handlers and cleanup logic do not operate on objects that may already be destroyed. Additionally, developers should avoid manually calling del on Django model instances and instead rely on the framework's built-in lifecycle management. Regular static analysis with tools like bandit and runtime monitoring with pyinstrument can help surface suspicious patterns before they manifest as security incidents.

Remediation of double free vulnerabilities in Django requires careful management of object lifecycles and reference semantics. The safest approach is to ensure that no code path attempts to delete or manipulate an object after it has been deallocated. One effective pattern is to replace direct deletion calls with Django's delete() method only when the object is confirmed to be in a stable state, and to avoid storing references to model instances in global variables or long-lived caches.

# Avoid this pattern that can lead to double free:

# models.py

from django.db import models

class MyModel(models.Model):

    data = models.TextField()

    def cleanup(self):

        # Risky: storing reference then deleting

        ref = MyModel.objects.get(pk=1)

        ref.delete()

        # If another part of the code holds 'ref', problems arise

        # Safer: delete directly without storing

        MyModel.objects.filter(pk=1).delete()

        # Or use a transaction to ensure atomicity

        with transaction.atomic():

            MyModel.objects.filter(pk=1).delete()

            # No lingering reference to the deleted object

            pass

        # Best practice: use signals or override save/delete methods

class MyModel(models.Model):

    def delete(self, *args, **kwargs):

        # Perform cleanup safely within the model

        super().delete(*args, **kwargs)

        # Cleanup logic that does not reference self after deletion

        pass

# views.py

from django.shortcuts import get_object_or_404

def my_view(request):

    obj = get_object_or_404(MyModel, pk=1)

    # Process obj

    obj.delete()  # Safe if no other references exist

    return HttpResponse('Deleted')

    # Ensure no background task holds a reference to 'obj'

    # Use Celery with weak references or task queues that clear references

    # after deletion

    # Example: Celery task that must not reference deleted models

@celery.task

def async_cleanup(id):

    try:

        obj = MyModel.objects.get(pk=id)

        obj.delete()

    except MyModel.DoesNotExist:

        pass  # Idempotent handling

    # Avoid passing the model instance itself to other tasks

    # Pass only the primary key

    # and retrieve inside the task if needed

# signals.py

from django.db.models.signals import post_delete

from django.dispatch import receiver

@receiver(post_delete, sender=MyModel)

def handle_deletion(sender, instance, **kwargs):

    # Perform cleanup that does not retain references

    # Avoid accessing 'instance' after this point

    pass

# settings.py

# Enable reference counting debug mode in development

import os

os.environ['PYTHONMALLOC'] = 'debug'

# In production, monitor with AddressSanitizer or Valgrind

# Use static analysis tools like bandit to flag unsafe delete patterns