CVE-2023-7152

描述

A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.

如何修補 CVE-2023-7152

要修補 CVE-2023-7152,請將受影響套件升級到下列已修補版本。

• —升級至 8b24aa36ba978eafc6114b6798b47b7bfecdca26 或更新版本
• —升級至 8b24aa36ba978eafc6114b6798b47b7bfecdca26 或更新版本
• —升級至 8b24aa36ba978eafc6114b6798b47b7bfecdca26 或更新版本
• —升級至 8b24aa36ba978eafc6114b6798b47b7bfecdca26 或更新版本

CVE-2023-7152 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 8b24aa36ba978eafc6114b6798b47b7bfecdca26 | from 0
• from 0, < 8b24aa36ba978eafc6114b6798b47b7bfecdca26 | from 0
• from 0, < 8b24aa36ba978eafc6114b6798b47b7bfecdca26 | from 0
• from 0, < 8b24aa36ba978eafc6114b6798b47b7bfecdca26 | from 0

CVSS 分數

參考連結(4)

• ADVISORYvuldb.com/?ctiid.249158
• ADVISORYvuldb.com/?id.249158
• PATCHgithub.com/jimmo/micropython/commit/8b24aa36ba978eafc6114b6798b47b7bfecdca26
• REPORTgithub.com/micropython/micropython/issues/12887