Critical Use-After-Free Vulnerability in MicroPython Package
Summary
DEBIAN-CVE-2024-8947: A vulnerability was found in MicroPython 1.22.2. Affects micropython versions < 1.24.0+ds-1. Fixed in 1.24.0+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MicroPython is a lean implementation of the Python programming language designed for microcontrollers and constrained environments. It provides a subset of Python's features, allowing developers to write Python code to control hardware. The package is widely used in IoT applications and embedded systems due to its lightweight nature and ease of use. However, a critical vulnerability has been identified in versions prior to 1.24.0+ds-1, which could lead to severe security risks if not addressed promptly.
Vulnerability Detail
A critical vulnerability has been discovered in MicroPython version 1.22.2, specifically in the file py/objarray.c. This vulnerability is categorized as a use-after-free issue, where memory that has already been freed may still be referenced. This could allow an attacker to exploit the vulnerability remotely, leading to potential arbitrary code execution or system crashes. The complexity of the attack is considered high, making exploitation difficult but not impossible. The patch identifier for this vulnerability is 4bed614e707c0644c06e117f848fa12605c711cd.
How To Fix
Minimum fixed version
1.24.0+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade micropythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
In summary, a critical use-after-free vulnerability has been identified in MicroPython versions prior to 1.24.0+ds-1. It is essential for users to upgrade to the patched version to mitigate potential security risks. Utilizing tools like Vulert can further enhance your ability to monitor and address vulnerabilities in your applications.
See every vulnerability recorded for micropython →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to arbitrary code execution or crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could expose your system to remote attacks, leading to unauthorized access, data breaches, or system instability.
Yes, upgrading to version 1.24.0+ds-1 or later will address the vulnerability and mitigate the associated risks.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, helping you maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for micropython.
