CVE-2024-8947: MicroPython Use After Free Vulnerability

CVE-2024-8947 Overview

CVE-2024-8947 is a use-after-free vulnerability [CWE-416] in MicroPython 1.22.2. The flaw resides in the py/objarray.c source file within the objarray component. When a bytes object is resized and copied into itself, the code may reference memory that has already been freed. The vulnerability is network-reachable but carries high attack complexity, making practical exploitation difficult. MicroPython is widely deployed on microcontrollers and embedded devices, where memory corruption can lead to crashes or potential code execution. The maintainers addressed the issue in version 1.23.0 through commit 4bed614e707c0644c06e117f848fa12605c711cd.

Critical Impact
Successful exploitation of the use-after-free condition in py/objarray.c can corrupt memory in MicroPython runtimes, leading to denial of service or possible code execution on affected embedded devices.

Affected Products

MicroPython 1.22.2
MicroPython releases prior to 1.23.0 that include the vulnerable py/objarray.c logic
Embedded firmware and IoT devices bundling the affected MicroPython runtime

Discovery Timeline

2024-09-17 - CVE-2024-8947 published to NVD
2024-09-24 - Last updated in NVD database
MicroPython 1.23.0 - Vendor releases fixed version containing patch 4bed614e707c0644c06e117f848fa12605c711cd

Technical Details for CVE-2024-8947

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the MicroPython objarray subsystem. MicroPython implements bytes, bytearray, and array types in py/objarray.c. When a bytes object is resized and the source operand of the copy is the same object being resized, the reallocation can free the original backing buffer. The code then continues to read from the now-dangling pointer when copying data into the freshly allocated buffer.

This self-referential resize pattern produces undefined behavior. Depending on heap layout and allocator state, the freed memory may already be reused by another allocation, causing data corruption, interpreter crashes, or controlled memory disclosure. On constrained embedded targets without modern heap hardening, the consequences can extend to arbitrary code execution.

Root Cause

The root cause is the absence of an aliasing check before reallocation in the affected objarray path. The implementation assumed the source buffer remained valid across the realloc call, but reallocating the destination invalidates the source pointer when both refer to the same object. The fix in commit 4bed614e707c0644c06e117f848fa12605c711cd ensures the data is preserved or copied safely when the source and destination alias one another.

Attack Vector

Exploitation requires the attacker to deliver crafted Python input to a MicroPython interpreter that triggers the self-referential bytes resize and copy operation. This typically means a deployment that evaluates untrusted scripts or processes attacker-controlled data through bytes manipulation. The CVE description marks the attack as remotely launchable but rates complexity as high and exploitation as difficult, reflecting the precise heap state needed to weaponize the dangling pointer.

No public proof-of-concept exploit code is available. Technical discussion of the underlying behavior is tracked in the MicroPython GitHub issue #13283.

Detection Methods for CVE-2024-8947

Indicators of Compromise

Unexpected crashes or hard faults on MicroPython-based devices during bytes or bytearray operations
Repeated interpreter restarts on embedded firmware that processes external input
Heap corruption diagnostics or watchdog resets correlated with script execution

Detection Strategies

Inventory firmware images and embedded products for MicroPython 1.22.2 or earlier and flag deployments that have not moved to 1.23.0
Audit application code paths that perform in-place bytes resize operations using the object as both source and destination
Run the affected interpreter under AddressSanitizer or a similar memory checker in lab builds to surface the use-after-free deterministically

Monitoring Recommendations

Collect device telemetry for unexpected reboots, panic logs, and stack traces referencing objarray symbols
Monitor ingress channels that feed Python expressions or serialized data into MicroPython interpreters on production devices
Track upstream MicroPython release notes and CVE feeds to identify follow-on memory safety fixes

How to Mitigate CVE-2024-8947

Immediate Actions Required

Upgrade affected deployments to MicroPython 1.23.0 or later, which contains commit 4bed614e707c0644c06e117f848fa12605c711cd
Rebuild and redistribute firmware images for IoT and embedded devices that statically link MicroPython
Restrict execution of untrusted Python code on devices that cannot be patched immediately

Patch Information

The upstream fix is available in the MicroPython v1.23.0 release and in the corresponding GitHub commit 4bed614. Vendors shipping MicroPython as part of board support packages should backport the commit if they cannot move to 1.23.0 wholesale.

Workarounds

Avoid application patterns that resize a bytes object using itself as the source operand
Validate and constrain the size of bytes and bytearray inputs received from external interfaces
Disable or sandbox any feature that evaluates attacker-controlled Python on the device until the patched runtime is deployed

bash

# Rebuild MicroPython from the patched source tree
git clone https://github.com/micropython/micropython.git
cd micropython
git checkout v1.23.0
make -C ports/unix submodules
make -C ports/unix