Page MenuHomePhabricator

CVE-2026-39934: With hidden mentees, ReassignMenteesJob runs as an infinite loop
Closed, ResolvedPublicSecurity

Description

I discovered ReassignMenteesJob runs over a thousand times per day for one cswiki former mentee:

[urbanecm@mwlog2002 /srv/mw-log]$ grep ReassignMenteesJob archive/GrowthExperiments.log-20260224 | grep Felix220  | wc -l
1434
[urbanecm@mwlog2002 /srv/mw-log]$ zgrep ReassignMenteesJob archive/GrowthExperiments.log-20260223.gz | grep Felix220  | wc -l
1426
[urbanecm@mwlog2002 /srv/mw-log]$

despite the mentor resigned over a month ago. The job is continuously rescheduled by the mechanism added in T354222: reassignMenteesJob is not able to finish in time when a mentor has too many mentees assigned:

2026-02-23 01:17:59.041757 [9aa82291-b683-49b0-b4f1-0ea8f9900835] mw-jobrunner.codfw.main-546746cf89-x62xw cswiki 1.46.0-wmf.16 GrowthExperiments INFO: GrowthExperiments\Mentorship\ReassignMentees::doReassignMentees processing 0 mentees {"mentees":0,"context.job_type":"reassignMenteesJob"} 
2026-02-23 01:17:59.042473 [9aa82291-b683-49b0-b4f1-0ea8f9900835] mw-jobrunner.codfw.main-546746cf89-x62xw cswiki 1.46.0-wmf.16 GrowthExperiments INFO: ReassignMenteesJob finished reassignment with 1 status {"status":true,"context.job_type":"reassignMenteesJob"} 
2026-02-23 01:17:59.043524 [9aa82291-b683-49b0-b4f1-0ea8f9900835] mw-jobrunner.codfw.main-546746cf89-x62xw cswiki 1.46.0-wmf.16 GrowthExperiments INFO: ReassignMenteesJob did not reassign all mentees, scheduling new job {"mentor":"Felix220","context.job_type":"reassignMenteesJob"}

despite there being zero mentees to process.

What is happening is this:

  1. The mentor resigned, ReassignMenteesJob fires for the first time. It reassigns the mentees to someone else (logs)
  2. Once the reassignment finishes, the job checks MentorStore::hasAnyMentees() to see whether there are any mentees remaining (cf. T354222 for why this was added)
  3. MentorStore::hasAnyMentees() checks for all mentees (including mentees whose accounts were hidden by an oversighter). Felix220 does have one hidden mentee, so this method returns true.
  4. ReassignMenteesJob fires again. It calls MentorStore::getMenteesByMentor() to find the list of mentees. By default, MentorStore::getMenteesByMentor _ignores_ hidden mentees. For Felix220, it returns an empty array.
  5. The job doesn't do anything and it returns successfully
  6. We go back to step 2, and the process repeats...infinitely

This is happening since r1077077: MentorStore::hasAnyMentees: Use more efficient implementation (T376124), which we merged in 2024 (!), which removed the exclusion of hidden users in MentorStore::hasAnyMentees().

WMF-NDA queries confirming the above findings:

{P89004}

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Michael changed the visibility from "Public (No Login Required)" to "Subscribers".Feb 24 2026, 11:12 AM
Michael changed the edit policy from "All Users" to "Subscribers".
Urbanecm_WMF changed the visibility from "Subscribers" to "Custom Policy".Feb 24 2026, 11:19 AM
Urbanecm_WMF changed the edit policy from "Subscribers" to "Custom Policy".
Urbanecm changed the visibility from "Custom Policy" to "Public (No Login Required)".Feb 24 2026, 11:19 AM
Urbanecm set Security to Software security bug.
Urbanecm added projects: Security, Security-Team.
Urbanecm changed the visibility from "Public (No Login Required)" to "Custom Policy".
Urbanecm changed the subtype of this task from "Task" to "Security Issue".
Urbanecm subscribed.

Fix attached

The fix needs to be applied on top of r1243136 to ensure a clear application.

Fix attached

The fix needs to be applied on top of r1243136 to ensure a clear application.

This looks sensible to me. I give it my virtual +2

Thanks! Moving to Doing, I'll deploy it soon.

This is not the easiest patch to deploy... To be able to deploy it w/o merge conflicts, we need to pull a bunch of code refactors to production... Here is a list of patches to backport to wmf.16:

095f9d41a79f5678bcd712b3381b6c687b2498b5 (Sergio, geForceVariant)
7d8940d87cbce001ac836ca78e4f9e27192a9a63 (SiteNotice)
d7c8e88419b102a2a5aa486c1908c530bfda06dd (IExperimentManager)
9a41649aeea90fc3625f383aaea33e5efe2c37ea (Thiemo, PHPDoc)
582cf4260f0c43f588b0b9dc0a68b1ef3c0e6a97 (Urbanecm, cleanup)
d9bbbc9b28c4586551d33c09e8f1f111539d6de3 (Urbanecm, test)

(the last two patches also need to be pulled to wmf.17, the rest is already there)

Doing this now...

Change #1243874 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/GrowthExperiments@master] SECURITY: ReassignMentees: Handle hidden users correctly

https://gerrit.wikimedia.org/r/1243874

Change #1243874 merged by jenkins-bot:

[mediawiki/extensions/GrowthExperiments@master] SECURITY: ReassignMentees: Handle hidden users correctly

https://gerrit.wikimedia.org/r/1243874

Change #1244011 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/GrowthExperiments@wmf/1.46.0-wmf.17] SECURITY: ReassignMentees: Handle hidden users correctly

https://gerrit.wikimedia.org/r/1244011

Change #1244012 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/GrowthExperiments@wmf/1.46.0-wmf.16] SECURITY: ReassignMentees: Handle hidden users correctly

https://gerrit.wikimedia.org/r/1244012

Change #1244012 merged by jenkins-bot:

[mediawiki/extensions/GrowthExperiments@wmf/1.46.0-wmf.16] SECURITY: ReassignMentees: Handle hidden users correctly

https://gerrit.wikimedia.org/r/1244012

Change #1244011 merged by jenkins-bot:

[mediawiki/extensions/GrowthExperiments@wmf/1.46.0-wmf.17] SECURITY: ReassignMentees: Handle hidden users correctly

https://gerrit.wikimedia.org/r/1244011

Urbanecm changed the visibility from "Custom Policy" to "Public (No Login Required)".Feb 25 2026, 11:39 PM
Urbanecm changed the edit policy from "Custom Policy" to "All Users".

Mission succeeded. The amount of reassignMenteesJob jobs should drop.

sbassett added a project: SecTeam-Processed.
sbassett added subscribers: ASanford-WMF, sbassett.

Thanks for the quick work to fix this issue and get it deployed and backported! @ASanford-WMF will track this for the next Wikimedia supplemental security release (T411394).

Checked https://logstash.wikimedia.org/goto/9d01ba6b23f6f82853c3e50f1bc0cc17 for ReassignMenteesJob - the number of reports is low now.

The security patches were pushed through gerrit I believe, so we should be fine to make this task public now, correct, @Urbanecm_WMF?

Mstyles renamed this task from With hidden mentees, ReassignMenteesJob runs as an infinite loop to CVE-2026-39934: With hidden mentees, ReassignMenteesJob runs as an infinite loop.Tue, Apr 7, 10:29 PM