An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there are no common scenarios in which an adversary can call _asyncio._swap_current_task but does not already have the ability to call arbitrary functions; and (3) there are no common scenarios in which sensitive information, which is not already accessible to an adversary, becomes accessible through this bug.
cpe:2.3:a:python:python:3.13.0:alpha0:*:*:*:*:*:*
3BA51E41-D221-431F-870F-536AF2867B50
OR
First appeared in a474e04388c2ef6aca75c26cb70a1b6200235feb, where given function was introduced.

Repro:
```python
import _asyncio

class DummyLoop:
    pass

class DummyTask:
    pass

l = DummyLoop()
_asyncio._swap_current_task(l, DummyTask())
t = _asyncio._swap_current_task(l, None)
```
Output:
```
Modules/gcmodule.c:461: visit_decref: Assertion "!_PyObject_IsFreed(op)" failed
Enable tracemalloc to get the memory block allocation traceback

object address  : 0x7fedad081130
object refcount : 1
object type     : 0x55f665a81fe0
object type name: dict
object repr     : Segmentation fault (core dumped)
```

I'm working on a fix.

<!-- gh-linked-prs -->
### Linked PRs
* gh-105989
* gh-106099
<!-- /gh-linked-prs -->

Crash in `_asyncio._swap_current_task` due to improper reference counting
This is a GitHub Issue
repo:cpython
owner:python
Title : Crash in `_asyncio._swap_current_task` due to improper reference counting
Issue date:

--- start body ---
First appeared in a474e04388c2ef6aca75c26cb70a1b6200235feb, where given function was introduced.

Repro:
```python
import _asyncio

class DummyLoop:
    pass

class DummyTask:
    pass

l = DummyLoop()
_asyncio._swap_current_task(l, DummyTask())
t = _asyncio._swap_current_task(l, None)
```
Output:
```
Modules/gcmodule.c:461: visit_decref: Assertion "!_PyObject_IsFreed(op)" failed
Enable tracemalloc to get the memory block allocation traceback

object address  : 0x7fedad081130
object refcount : 1
object type     : 0x55f665a81fe0
object type name: dict
object repr     : Segmentation fault (core dumped)
```

I'm working on a fix.

<!-- gh-linked-prs -->
### Linked PRs
* gh-105989
* gh-106099
<!-- /gh-linked-prs -->

--- end body ---

comments :
--- start comments ---

--- end comments ---