CVE-2024-8948 MicroPython objint.c mpz_as_bytes heap-based overflow
A heap-based buffer overflow in MicroPython allows remote attackers to execute arbitrary code or cause denial of service via integer conversion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-8948?
CVE-2024-8948 is a medium-severity memory corruption vulnerability in MicroPython, published on 17 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 908ab1ceca15ee6fd0ef82ca4cba770a3ec41894. It is recommended to apply a patch to fix this issue. In micropython objint component, converting zero from int to bytes leads to heap buffer-overflow-write at mpz_as_bytes.
Which versions are affected by CVE-2024-8948?
9 open source packages ship an affected version, including micropython-copy, micropython-io and micropython-os. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
micropython-copy PyPI | All versions | None |
micropython-copy PyPI | All versions to 3.3.3.post3 | None |
micropython-copy PyPI | All versions to 3.3.3.post3 | None |
micropython-io PyPI | All versions | None |
micropython-io PyPI | All versions to 0.1 | None |
micropython-io PyPI | All versions to 0.1 | None |
3 more packages
micropython-os PyPI | All versions | None |
micropython-os PyPI | All versions to 0.8 | None |
micropython-os PyPI | All versions to 0.8 | None |
Products include Micropython Micropython.
How do I fix CVE-2024-8948?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-8948 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8948 exists.
Other vulnerabilities in MicroPython
- CVE-2023-7158 MicroPython objslice.c slice_indices heap-based overflow
- CVE-2024-8946 MicroPython VFS Unmount vfs.c mp_vfs_umount heap-based overflow
- CVE-2024-8947 MicroPython objarray.c use after free
- CVE-2023-7152 MicroPython modselect.c poll_set_add_fd use after free
- CVE-2026-1998 micropython runtime.c mp_import_all memory corruption
Sources
Also known as DEBIAN-CVE-2024-8948, GHSA-vh3x-525m-jp4r, PYSEC-2024-87, PYSEC-2024-88, PYSEC-2024-89, UBUNTU-CVE-2024-8948.