CVE-2024-8946

Advisory

Affected versions of the MicroPython package are vulnerable to Buffer Overflow due to improper length-based comparison of the unmount request string and the mounted path. The `mp_vfs_umount` function in the `extmod/vfs.c` module performs a comparison based solely on the length of the unmount string, which can result in a heap-based buffer overflow when the unmount string is longer than expected. An attacker can exploit this by sending a specially crafted unmount request remotely to trigger the overflow, potentially corrupting memory and causing a denial of service or remote code execution.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-74qm-4v7r-jw2f
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8946