PT-2023-32911 · Unknown · Micropython

Junwha Hong + 2 · Publicado 2023-12-28 · Atualizado 2024-05-17 · CVE-2023-7152

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MicroPython versions 1.21.0 through 1.22.0-preview

Description A critical issue has been found in the function poll set add fd of the file extmod/modselect.c, leading to use after free. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply the patch identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. As a temporary workaround, consider disabling the poll set add fd function until the patch is applied.

Exploit

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2023-7152

PYSEC-2023-256

PYSEC-2023-257

PYSEC-2023-258

PYSEC-2023-259

Produtos afetados

Micropython

Referências · 23

• 🔥 https://github.com/micropython/micropython/issues/12887 · Exploit
• https://github.com/jimmo/micropython/commit/8b24aa36ba978eafc6114b6798b47b7bfecdca26 · Correção
• https://cve.org/CVERecord?id=CVE-2023-7152 · Nota de Segurança
• https://t.me/cvenotify/65599 · Publicação no Telegram
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TEK46QAJOXXDZOWOIE2YACUOCZFWOBCK · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-7152 · Aviso do Fabricante
• https://t.me/cvenotify/75683 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2023-257 · Aviso do Fabricante
• https://t.me/cvenotify/65632 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2023-258 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-7152 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-259 · Aviso do Fabricante
• https://vuldb.com/?ctiid.249158 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4E2HYWCZB5R4SHY4SZZZSFDMD64N4SOZ · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1740622778540130397 · Publicação no Twitter