PT-2023-32911 · Unknown · Micropython

Junwha Hong + 2 · Published 2023-12-28 · Updated 2024-05-17 · CVE-2023-7152

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MicroPython versions 1.21.0 through 1.22.0-preview

Description A critical issue has been found in the function poll set add fd of the file extmod/modselect.c, leading to use after free. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply the patch identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. As a temporary workaround, consider disabling the poll set add fd function until the patch is applied.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2023-7152

PYSEC-2023-256

PYSEC-2023-257

PYSEC-2023-258

PYSEC-2023-259

Affected Products

Micropython

References · 23

• 🔥 https://github.com/micropython/micropython/issues/12887 · Exploit
• https://github.com/jimmo/micropython/commit/8b24aa36ba978eafc6114b6798b47b7bfecdca26 · Patch
• https://cve.org/CVERecord?id=CVE-2023-7152 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TEK46QAJOXXDZOWOIE2YACUOCZFWOBCK · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-7152 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-257 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7152 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-259 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4E2HYWCZB5R4SHY4SZZZSFDMD64N4SOZ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/D3WWY5JY4RTJE25APB4REGDUDPATG6H7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-7152 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-256 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-7152 · Vendor Advisory
• https://t.me/cvenotify/65599 · Telegram Post