CVE-2023-7158 MicroPython objslice.c slice_indices heap-based overflow

What is CVE-2023-7158?

CVE-2023-7158 is a high-severity memory corruption vulnerability in MicroPython, published on 29 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2023-7158?

It affects 1 product.

Products include Micropython Micropython.

How do I fix CVE-2023-7158?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-7158 being exploited?

There is no known exploitation of CVE-2023-7158 in the wild and no public exploit code.

Other vulnerabilities in MicroPython

• CVE-2024-8946 MicroPython VFS Unmount vfs.c mp_vfs_umount heap-based overflow Medium 6.9
• CVE-2024-8948 MicroPython objint.c mpz_as_bytes heap-based overflow Medium 6.9
• CVE-2024-8947 MicroPython objarray.c use after free Medium 6.3
• CVE-2023-7152 MicroPython modselect.c poll_set_add_fd use after free Medium 5.5
• CVE-2026-1998 micropython runtime.c mp_import_all memory corruption Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x33q-m927-7mq6, UBUNTU-CVE-2023-7158, openSUSE-SU-2024:13566-1.