GitHub Advisoryadvisory · PyPI

GHSA-vh3x-525m-jp4r heap-buffer-overflow in MicroPython

MEDIUM Published 2024-09-17 Modified 2024-09-24 Official page ↗
Aliases
CVE-2024-8948
Ecosystem
PyPI
Packages
micropython-copy, micropython-io, micropython-os
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-122, CWE-787
Reviewed
2024-09-24

Affected packages

• PyPI micropython-copy: <= 3.3.3.post3 (no fix yet) • PyPI micropython-io: <= 0.1 (no fix yet) • PyPI micropython-os: <= 0.8 (no fix yet)

Description

A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 908ab1ceca15ee6fd0ef82ca4cba770a3ec41894. It is recommended to apply a patch to fix this issue. In micropython objint component, converting zero from int to bytes leads to heap buffer-overflow-write at mpz_as_bytes.

Related

Alias · CVE (1)

  • CVE-2024-8948 A vulnerability was found in MicroPython 1.23.0. vulnerability

Weakness · CWE (2)

  • CWE-122 Heap-based Buffer Overflow weakness
  • CWE-787 Out-of-bounds Write weakness

References