PT-2023-8211 · Unknown · Micropython

Qbit · Publicado 2023-12-28 · Atualizado 2024-06-15 · CVE-2023-7158

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MicroPython versions prior to 1.22.0

Description A critical issue in MicroPython is related to the slice indices function in the objslice.c file, which can lead to a heap-based buffer overflow. This can be exploited remotely, potentially affecting the confidentiality, integrity, and availability of protected information. The issue has been disclosed publicly and may be used by attackers.

Recommendations For MicroPython versions prior to 1.22.0, upgrade to version 1.22.0 to address this issue. As a temporary workaround, consider restricting access to the slice indices function in the objslice.c file until the upgrade is applied.

Exploit

Correção

Memory Corruption

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-787

CWE-122

Identificadores relacionados

BDU:2024-00209

CVE-2023-7158

OPENSUSE-SU-2024:13566-1

Produtos afetados

Micropython

Referências · 24

• 🔥 https://github.com/micropython/micropython/issues/13007 · Exploit
• https://github.com/micropython/micropython/pull/13039/commits/f397a3ec318f3ad05aa287764ae7cef32202380f · Correção
• https://github.com/micropython/micropython/releases/tag/v1.22.0 · Correção
• https://github.com/micropython/micropython/pull/13039 · Nota
• https://t.me/cibsecurity/73908 · Publicação no Telegram
• https://twitter.com/vuldb/status/1740391676664004776 · Publicação no Twitter
• https://t.me/cvenotify/65629 · Publicação no Telegram
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TEK46QAJOXXDZOWOIE2YACUOCZFWOBCK · Aviso do Fabricante
• https://t.me/cvenotify/75684 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2023-7158 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-7158 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-7158 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-7158 · Aviso do Fabricante
• https://t.me/cvenotify/75880 · Publicação no Telegram
• https://t.me/cvenotify/66395 · Publicação no Telegram