Lucene search

VulDBVULNRICHMENT:CVE-2024-8948

HistorySep 17, 2024 - 6:50 p.m.

CVE-2024-8948 MicroPython objint.c mpz_as_bytes heap-based overflow

2024-09-1718:50:17

CWE-122

VulDB

github.com

micropython

objint.c

mpz_as_bytes

heap-based overflow

buffer overflow

patch

remote attack

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:L/SI:N/VA:L/SA:N

AI Score

7.1

Confidence

Low

EPSS

0.001

Percentile

20.9%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 908ab1ceca15ee6fd0ef82ca4cba770a3ec41894. It is recommended to apply a patch to fix this issue. In micropython objint component, converting zero from int to bytes leads to heap buffer-overflow-write at mpz_as_bytes.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:micropython:micropython:*:*:*:*:*:*:*:*"
    ],
    "vendor": "micropython",
    "product": "micropython",
    "versions": [
      {
        "status": "affected",
        "version": "1.23.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

github.com/micropython/micropython/commit/908ab1ceca15ee6fd0ef82ca4cba770a3ec41894

github.com/micropython/micropython/issues/13041

vuldb.com/?ctiid.277766

vuldb.com/?id.277766

vuldb.com/?submit.409317

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:L/SI:N/VA:L/SA:N

AI Score

7.1

Confidence

Low

EPSS

0.001

Percentile

20.9%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-8948