MicroPython objslice.c slice_indices heap-based overflow

Vulnerability

A critical heap-buffer-overflow vulnerability exists in MicroPython up to version 1.21.0, specifically in the slice_indices function in objslice.c [1][2]. The bug arises from a type-confusion issue: when slice.indices() is called with a float argument (e.g., slice_obj.indices(0.0)), the function mp_obj_int_get_checked misinterprets the internal mp_obj_float structure as an mp_obj_int, reading the mpz field from an incorrect offset [2][3]. This leads to out-of-bounds memory access on the heap, as the float object is smaller than the expected int structure [2].

Exploitation

An attacker can trigger this vulnerability remotely by sending specially crafted Python code that invokes slice.indices() with a float argument [2]. No authentication is required, and the attack can be performed over the network if MicroPython is used in a context that accepts untrusted code—for example, in a web server, IoT device, or REPL accessible over a network [1][2]. A proof-of-concept exploit has been published [2]. The exploitation does not require any special user interaction beyond executing the malicious code.

Impact

Successful exploitation results in a heap-buffer-overflow, which can corrupt adjacent heap memory, potentially leading to arbitrary code execution or a denial of service [1][2]. The type confusion allows the attacker to read or write memory beyond the bounds of the original allocation, compromising confidentiality, integrity, and availability [2]. The impact is rated as critical with a CVSS score indicating remote exploitability [1].

Mitigation

The vulnerability is fixed in MicroPython version 1.22.0, released on 2023-12-28 [1][3]. Users should upgrade to this version immediately. The fix validates that the argument to indices() is an integer, preventing the type confusion [3]. For environments where upgrading is not immediately possible, the only available workaround is to avoid passing float values to slice.indices() in any user-supplied code, although this may not be practical in all deployment scenarios [2][3]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.