Skip to main content

Use After Free

CVE-2024-8947

High
8.1/10

Summary

A vulnerability was found in MicroPython, and it has been declared critical. The vulnerability affects an unknown functionality of the file "py/objarray.c". The manipulation leads to a Use-After-Free condition. The attack can be launched remotely, though the complexity of the attack is rather high, and exploitation appears to be difficult. It is recommended that the affected component be upgraded. In the MicroPython "objarray" component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed. This issue affects micropython versions prior to v1.23.0.

  • HIGH
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-416 - Use After Free

Use-after-free (UaF) vulnerability occurs when the application is using a pointer to memory that has been freed. Any attempt to read/write to a buffer after it is de-allocated allows memory corruption, sensitive information exposure, and can potentially lead to arbitrary code execution.

References

Advisory Timeline

  • Published