CVE-2024-8946

MEDIUM EPSS 58.6%
Published Sep 17, 20241y ago · Modified Jun 17, 20261w ago
6.9 CVSS 4.0
Medium
Find Similar
Published Sep 17, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mp_vfs_umount of the file extmod/vfs.c of the component VFS Unmount Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 29943546343c92334e8518695a11fc0e2ceea68b. It is recommended to apply a patch to fix this issue. In the VFS unmount process, the comparison between the mounted path string and the unmount requested string is based solely on the length of the unmount string, which can lead to a heap buffer overflow read.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
58.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-122
CWE-787 Out-of-bounds Write Memory Safety

Affected Products 1

VendorProductVersionRange
micropythonmicropython1.23.0any

References 6

  • github.com https://github.com/micropython/micropython/commit/29943546343c92334e8518695a11fc0e2ceea68b
    Patch
  • github.com https://github.com/micropython/micropython/issues/13006
    ExploitIssue Tracking
  • github.com https://github.com/micropython/micropython/issues/13006#issuecomment-1820309455
    ExploitThird Party Advisory
  • vuldb.com https://vuldb.com/?ctiid.277764
    Permissions Required
  • vuldb.com https://vuldb.com/?id.277764
    Third Party Advisory
  • vuldb.com https://vuldb.com/?submit.409312
    Third Party Advisory

Remediation

  • github.com https://github.com/micropython/micropython/commit/29943546343c92334e8518695a11fc0e2ceea68b
    Patch