CVE-2024-8946 MicroPython VFS Unmount vfs.c mp_vfs_umount heap-based overflow
A heap-based buffer overflow in MicroPython's VFS unmount handler allows remote attackers to execute arbitrary code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-8946?
CVE-2024-8946 is a medium-severity memory corruption vulnerability in MicroPython, published on 17 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mp_vfs_umount of the file extmod/vfs.c of the component VFS Unmount Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 29943546343c92334e8518695a11fc0e2ceea68b. It is recommended to apply a patch to fix this issue. In the VFS unmount process, the comparison between the mounted path string and the unmount requested string is based solely on the length of the unmount string, which can lead to a heap buffer overflow read.
Which versions are affected by CVE-2024-8946?
12 open source packages ship an affected version, including micropython-copy, micropython-io and micropython-os-path. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
micropython-copy PyPI | All versions | None |
micropython-copy PyPI | All versions to 3.3.3.post3 | None |
micropython-copy PyPI | All versions to 3.3.3.post3 | None |
micropython-io PyPI | All versions | None |
micropython-io PyPI | All versions to 0.1 | None |
micropython-io PyPI | All versions to 0.1 | None |
6 more packages
micropython-os-path PyPI | All versions | None |
micropython-os-path PyPI | All versions to 0.1.3 | None |
micropython-os-path PyPI | All versions to 0.1.3 | None |
micropython-string PyPI | All versions | None |
micropython-string PyPI | All versions to 0.1 | None |
micropython-string PyPI | All versions to 0.1 | None |
Products include Micropython Micropython.
How do I fix CVE-2024-8946?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-8946 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8946 exists.
Other vulnerabilities in MicroPython
- CVE-2023-7158 MicroPython objslice.c slice_indices heap-based overflow
- CVE-2024-8948 MicroPython objint.c mpz_as_bytes heap-based overflow
- CVE-2024-8947 MicroPython objarray.c use after free
- CVE-2023-7152 MicroPython modselect.c poll_set_add_fd use after free
- CVE-2026-1998 micropython runtime.c mp_import_all memory corruption
Sources
Also known as DEBIAN-CVE-2024-8946, GHSA-74qm-4v7r-jw2f, PYSEC-2024-91, PYSEC-2024-93, PYSEC-2024-95, PYSEC-2024-96 and 1 more.