PT-2023-8211 · Unknown · Micropython

Qbit · Published 2023-12-28 · Updated 2024-06-15 · CVE-2023-7158

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MicroPython versions prior to 1.22.0

Description A critical issue in MicroPython is related to the slice indices function in the objslice.c file, which can lead to a heap-based buffer overflow. This can be exploited remotely, potentially affecting the confidentiality, integrity, and availability of protected information. The issue has been disclosed publicly and may be used by attackers.

Recommendations For MicroPython versions prior to 1.22.0, upgrade to version 1.22.0 to address this issue. As a temporary workaround, consider restricting access to the slice indices function in the objslice.c file until the upgrade is applied.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2024-00209

CVE-2023-7158

OPENSUSE-SU-2024:13566-1

Affected Products

Micropython

References · 24

• 🔥 https://github.com/micropython/micropython/issues/13007 · Exploit
• https://github.com/micropython/micropython/pull/13039/commits/f397a3ec318f3ad05aa287764ae7cef32202380f · Patch
• https://github.com/micropython/micropython/releases/tag/v1.22.0 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TEK46QAJOXXDZOWOIE2YACUOCZFWOBCK · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-7158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7158 · Security Note
• https://ubuntu.com/security/CVE-2023-7158 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-7158 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/D3WWY5JY4RTJE25APB4REGDUDPATG6H7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00209 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4E2HYWCZB5R4SHY4SZZZSFDMD64N4SOZ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-7158 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13566-1 · Vendor Advisory
• https://github.com/micropython/micropython/pull/13039 · Note
• https://t.me/cibsecurity/73908 · Telegram Post