Critical Heap-Based Buffer Overflow in MicroPython - CVE-2024-8948
Summary
DEBIAN-CVE-2024-8948: A vulnerability was found in MicroPython 1.23.0. Affects micropython versions < 1.24.0+ds-1. Fixed in 1.24.0+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MicroPython is a lean implementation of Python 3 designed for microcontrollers and embedded systems. It allows developers to write Python code to control hardware components, making it a popular choice for IoT projects. The package is lightweight and optimized for performance, but it has been found to have a critical vulnerability that could be exploited remotely.
Vulnerability Detail
A critical vulnerability has been identified in MicroPython version 1.23.0, specifically in the function mpz_as_bytes located in the file py/objint.c. This vulnerability allows for a heap-based buffer overflow, which can be exploited remotely. The issue arises when converting zero from int to bytes, leading to potential unauthorized memory access and manipulation. The exploit has been publicly disclosed, making it imperative for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
1.24.0+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade micropythonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected function mpz_as_bytes until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The vulnerability CVE-2024-8948 in MicroPython poses a significant risk due to its potential for remote exploitation. Users are strongly advised to update to the patched version 1.24.0+ds-1 to mitigate this risk. Monitoring tools like Vulert can assist in keeping track of such vulnerabilities in the future.
See every vulnerability recorded for micropython →
FAQ
CVE-2024-8948 is a critical vulnerability in MicroPython that allows for a heap-based buffer overflow, potentially leading to unauthorized memory access.
If you are using MicroPython version 1.23.0, you are affected by this vulnerability. Check your version using 'micropython --version'.
Not fixing this vulnerability could allow attackers to exploit the buffer overflow, potentially leading to remote code execution or system compromise.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring code access.
More information can be found in the official CVE database or by visiting the vulnerability report at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-8948.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for micropython.
