CVE-2023-7152

Critical use-after-free vulnerability in MicroPython 1.21.0/1.22.0-preview.

• CVSS 9.8
• CWE-416: Use After Free
• Memory Corruption
• Remote

A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.

CVE

CVE-2023-7152

CWE

CWE-416: Use After Free

CVSS base score

9.8

Published

2023-12-29

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Memory Corruption

Subcategory

Use-After-Free Errors

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to MicroPython version 1.22.1 or higher

class PollSet:
    def __init__(self):
        self.fd_map = {}

    def poll_set_add_fd(self, fd, event):
        self.fd_map[fd] = event

    def poll_set_remove_fd(self, fd):
        if fd in self.fd_map:
            del self.fd_map[fd]
        else:
            raise ValueError("File descriptor not found.")

poll_set = PollSet()
poll_set.poll_set_add_fd(1, 'READ')
poll_set.poll_set_remove_fd(1)

class PollSet:
    def __init__(self):
        self.fd_map = {}

    def poll_set_add_fd(self, fd, event):
        if fd in self.fd_map:
            raise ValueError("File descriptor already in use.")
        
        self.fd_map[fd] = event

    def poll_set_remove_fd(self, fd):
        if fd in self.fd_map:
            del self.fd_map[fd]
        else:
            raise ValueError("File descriptor not found.")

poll_set = PollSet()
poll_set.poll_set_add_fd(1, 'READ')
poll_set.poll_set_remove_fd(1)

@misc{vaitp:cve20237152,
  title        = {{Critical use-after-free vulnerability in MicroPython 1.21.0/1.22.0-preview.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-7152},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-7152/}}
}