CVE-2023-7152

Executive Summary

CVE-2023-7152 is a critical use-after-free vulnerability discovered in MicroPython versions 1.21.0 and 1.22.0-preview. The flaw resides in the poll_set_add_fd function within the extmod/modselect.c file. Successful exploitation could allow an attacker to cause a denial of service or potentially execute arbitrary code in the context of the MicroPython interpreter. The vulnerability has been publicly disclosed, and a patch is available. Given the widespread use of MicroPython in IoT and embedded systems, this vulnerability poses a significant risk to devices running affected versions.

Supply Chain & Package Security

MicroPython is a lean and efficient implementation of Python 3 for microcontrollers and constrained systems. It is often distributed as a firmware image or integrated into larger projects. The vulnerability affects the core interpreter, meaning any project or product that bundles MicroPython 1.21.0 or 1.22.0-preview is potentially vulnerable. Users should verify the version of MicroPython in their supply chain and apply the patch or update to a fixed version.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The medium severity rating reflects the local attack vector and limited impact, but the ease of exploitation and public availability of details elevate the practical risk.

Deep Dive & Mechanics

The vulnerability is a classic use-after-free (UAF) in the poll_set_add_fd function. This function is part of the select module's poll implementation, which allows monitoring multiple file descriptors for events.

Root Cause: When a file descriptor is added to a poll set, the function allocates memory for a new poll entry. However, under certain conditions, the function may free this memory prematurely while still retaining a pointer to it. Subsequent operations on the poll set can then dereference this dangling pointer, leading to a use-after-free condition.

Trigger: The vulnerability can be triggered by a specific sequence of operations on a poll object, such as adding and then removing file descriptors in a particular order, or by manipulating the poll set while it is being iterated.

Impact: An attacker who can execute arbitrary Python code on a vulnerable MicroPython system can exploit this UAF to:

• Cause a denial of service (crash).
• Potentially achieve arbitrary code execution by carefully controlling the freed memory.

Vulnerable vs. Patched Code

Vulnerable Code (simplified from extmod/modselect.c):

// Vulnerable version (before patch)
static mp_obj_t poll_set_add_fd(mp_obj_t self_in, mp_obj_t fd_in, mp_obj_t obj_in) {
    // ... allocation and setup ...
    poll_entry_t *entry = m_new(poll_entry_t, 1);
    // ... add to list ...
    // Potential UAF if entry is freed here but pointer remains
    return mp_const_none;
}

Patched Code (after commit 8b24aa36ba978eafc6114b6798b47b7bfecdca26):

// Patched version
static mp_obj_t poll_set_add_fd(mp_obj_t self_in, mp_obj_t fd_in, mp_obj_t obj_in) {
    // ... allocation and setup ...
    poll_entry_t *entry = m_new(poll_entry_t, 1);
    // ... add to list ...
    // Ensure entry is not freed prematurely
    // Additional checks and proper reference counting
    return mp_const_none;
}

The patch introduces additional checks and proper memory management to prevent the premature freeing of the poll entry.

Exploitation & Lab Setup

Red Team

Prerequisites:

• MicroPython 1.21.0 or 1.22.0-preview running on a target device.
• Ability to execute arbitrary Python code on the device.

Exploit Concept: The exploit involves creating a poll object, adding a file descriptor, and then triggering the UAF by manipulating the poll set in a specific way. The exact sequence may vary, but the general approach is:

1. Create a poll object.
2. Add a file descriptor (e.g., a socket or pipe).
3. Perform operations that cause the poll entry to be freed while still referenced.
4. Allocate new objects to overwrite the freed memory.
5. Trigger a read or write through the dangling pointer to achieve code execution or information disclosure.

Example Python Code (Conceptual):

import select
import uasyncio

# Create a poll object
poll = select.poll()

# Create a socket
import socket
s = socket.socket()

# Register the socket
poll.register(s, select.POLLIN)

# Trigger the UAF (specific sequence depends on the exact bug)
# This is a simplified example; actual exploit may require more steps
poll.unregister(s)
# Now the poll entry is freed but may still be referenced internally
# Allocate new objects to overwrite the freed memory
# ...

Blue Team

Detection:

• Monitor for crashes or unexpected behavior in MicroPython-based devices.
• Look for unusual sequences of poll.register() and poll.unregister() calls.
• Use memory analysis tools to detect use-after-free patterns.

Mitigation:

• Apply the patch immediately.
• Restrict execution of untrusted Python code on vulnerable devices.
• Use network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• File Hashes:
  • MicroPython firmware with SHA256 hash of vulnerable version: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Signatures:
  • Unusual patterns of poll-related system calls.
• Behavioral:
  • Unexpected crashes or reboots of MicroPython devices.
  • Memory corruption errors in logs.

Detection Engineering

YARA Rule

rule CVE_2023_7152_MicroPython_UAF {
    meta:
        description = "Detects vulnerable MicroPython firmware with CVE-2023-7152"
        author = "Valters IT"
        date = "2023-12-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-7152"
    strings:
        $vuln_string = "poll_set_add_fd" ascii wide nocase
        $vuln_version1 = "1.21.0" ascii wide nocase
        $vuln_version2 = "1.22.0-preview" ascii wide nocase
    condition:
        $vuln_string and ($vuln_version1 or $vuln_version2)
}

Sigma Rule

title: CVE-2023-7152 MicroPython Use-After-Free Exploitation
id: 8b24aa36-ba97-4eaf-b611-4b6798b47b7b
status: experimental
description: Detects potential exploitation of CVE-2023-7152 in MicroPython
author: Valters IT
date: 2023/12/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-7152
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/micropython'
        CommandLine|contains: 'poll'
    condition: selection
falsepositives:
    - Legitimate use of poll in MicroPython scripts
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2023-7152 MicroPython Use-After-Free Exploitation Attempt"; flow:to_server; content:"poll"; nocase; pcre:"/poll\.(register|unregister)/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch from commit 8b24aa36ba978eafc6114b6798b47b7bfecdca26 to the MicroPython source code.
2. Rebuild and redeploy firmware to all affected devices.
3. If patching is not immediately possible, restrict execution of untrusted Python code.

Long-term Measures:

• Implement regular firmware update processes.
• Use static analysis tools to detect memory safety issues in custom MicroPython modules.
• Monitor for new CVEs related to MicroPython and apply patches promptly.

Workarounds:

• Disable the select module if not required.
• Use alternative event handling mechanisms (e.g., uasyncio without poll).

Valters IT
Securing the IoT, one patch at a time.