Buffer overflow in Micropython
CVE-2023-7158
A vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180.
Vulnerability class: Buffer Overflow
EPSS: 0.012 (65.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Micropython
- N/a Micropython — versions 1.13.0, 1.14.0, 1.15.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, Third Party Advisory)
- cna@vuldb.com (issue-tracking, Exploit, exploit, Issue Tracking)
- cna@vuldb.com (issue-tracking, Issue Tracking)
- cna@vuldb.com (issue-tracking, Patch, patch)
- cna@vuldb.com (Release Notes, patch)
- cna@vuldb.com
- cna@vuldb.com
- cna@vuldb.com
Frequently asked questions
- What is CVE-2023-7158?
- CVE-2023-7158 is a high-severity vulnerability in Micropython, classified under Heap-based Buffer Overflow. CVSS score: 7.3/10. Published 2023-12-29.
- How severe is CVE-2023-7158?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2023-7158 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.