CVE-2024-8947

What it actually does

Use-after-free condition in py/objarray.c triggered when a bytes object is resized while being copied into itself, allowing reference to previously freed memory.

Why it matters to the business

Attackers may crash devices or execute arbitrary code on systems running vulnerable MicroPython versions, disrupting IoT, embedded, and automation deployments that rely on the interpreter.

How an attack unfolds

An attacker supplies input that causes a bytes object to be resized during an in-place copy operation, resulting in a dangling reference to freed memory that can be leveraged for memory corruption and potential code execution.

How to fix it

Upgrade MicroPython to version 1.23.0 or apply commit 4bed614e707c0644c06e117f848fa12605c711cd. Rebuild and redeploy all affected firmware images.

How to confirm the fix worked

Verify the installed MicroPython version is 1.23.0 or newer; confirm the patch commit is present in the source tree; run regression tests covering objarray resize and copy scenarios.

Typical attack path

1. Identify a remotely reachable MicroPython instance accepting untrusted input that triggers objarray operations.
2. Craft input causing a bytes object to be resized while copied into itself.
3. Trigger the use-after-free condition to corrupt memory.
4. Leverage the corruption to achieve code execution or denial of service.

How to detect it

Review application logs and crash dumps for unexpected memory faults or interpreter aborts during bytes or array operations; inspect network traffic for inputs that manipulate object sizes.

What your security team should do

• Prioritize upgrade of all production MicroPython deployments to 1.23.0 within the next maintenance window.
• Scan source repositories and build pipelines for the vulnerable commit and block merges until patched.
• Monitor upstream MicroPython releases and ecosystem packages for any additional downstream fixes.