{"id":"CVE-2023-7152","aliases":["EUVD-2023-0145","GHSA-jpcc-65j8-6q37","PYSEC-2023-256","PYSEC-2023-257","PYSEC-2023-258","PYSEC-2023-259","UBUNTU-CVE-2023-7152"],"status":"published","title":"MicroPython modselect.c poll_set_add_fd use after free","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00892,"percentile":0.59672,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2023-12-29T04:31:04Z","modified":"2026-10-28T10:36:24Z","affected":[{"source":"osv","ecosystem":"PyPI","package":"micropython-copy","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"8b24aa36ba978eafc6114b6798b47b7bfecdca26"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.1","0.0.2","3.3.3-2","3.3.3.post3"]},{"source":"osv","ecosystem":"PyPI","package":"micropython-io","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"8b24aa36ba978eafc6114b6798b47b7bfecdca26"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.1"]},{"source":"osv","ecosystem":"PyPI","package":"micropython-os","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"8b24aa36ba978eafc6114b6798b47b7bfecdca26"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.3","0.2.4","0.3","0.3.1","0.4.1","0.4.2","0.4.3","0.4.4","0.6","0.7","0.7.1","0.8"]},{"source":"osv","ecosystem":"PyPI","package":"micropython-select","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"8b24aa36ba978eafc6114b6798b47b7bfecdca26"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.1","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.1","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.2","0.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"giac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.3.57+dfsg1-2build1","1.2.3.57+dfsg1-2build2","1.2.3.57+dfsg1-2build3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"giac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.9.69+dfsg1-2build1","1.5.0.85+dfsg1-2","1.5.0.85+dfsg1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"giac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0.41+dfsg1-1","1.7.0.39+dfsg2-1build1","1.7.0.39+dfsg2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"giac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0.35+dfsg2-1.1","1.9.0.59+dfsg2-1","1.9.0.69+dfsg2-1","1.9.0.93+dfsg2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"giac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0.93+dfsg2-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"giac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0.93+dfsg2-3build2","1.9.0.93+dfsg2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"giac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0.93+dfsg2-3build1","1.9.0.93+dfsg2-3build2"]}],"products":[{"vendor":"micropython","product":"micropython"}],"references":[{"url":"https://vuldb.com/?id.249158","tags":["vdb-entry","technical-description","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://vuldb.com/?ctiid.249158","tags":["signature","permissions-required","x_transferred","Permissions Required","Third Party Advisory","VDB Entry","report","advisory"]},{"url":"https://github.com/micropython/micropython/issues/12887","tags":["exploit","issue-tracking","x_transferred","Exploit","Issue Tracking","report"]},{"url":"https://github.com/jimmo/micropython/commit/8b24aa36ba978eafc6114b6798b47b7bfecdca26","tags":["patch","x_transferred","Patch","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEK46QAJOXXDZOWOIE2YACUOCZFWOBCK/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4E2HYWCZB5R4SHY4SZZZSFDMD64N4SOZ/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D3WWY5JY4RTJE25APB4REGDUDPATG6H7/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7152","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jpcc-65j8-6q37"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7152.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-7152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-7152","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-7152","title":"MicroPython modselect.c poll_set_add_fd use after free","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","status":"published","published":"2023-12-29T04:31:04.054Z","modified":"2025-02-13T17:27:04.101Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"},{"version":"2.0","score":5.2,"vector":"AV:A/AC:L/Au:S/C:P/I:P/A:P","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:35:33.794347Z"}],"euvd":[{"id":"EUVD-2023-0145","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","status":"published","published":"2023-12-29T04:31:04Z","modified":"2025-02-13T17:27:04Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:03:47.607822Z"}],"ghsa":[{"id":"GHSA-jpcc-65j8-6q37","title":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0...","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","status":"published","published":"2023-12-29T06:30:30Z","modified":"2023-12-29T06:30:36Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:55:17.557989Z"}],"nvd":[{"id":"CVE-2023-7152","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","status":"published","published":"2023-12-29T05:15:09.473Z","modified":"2026-06-17T06:52:11.407Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5.2,"vector":"AV:A/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:08:59.830468Z"}],"osv":[{"id":"CVE-2023-7152","title":"MicroPython modselect.c poll_set_add_fd use after free","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","status":"published","published":"2023-12-29T04:31:04.054Z","modified":"2026-10-28T10:36:24.084375341Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"PYSEC-2023-256","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","status":"published","published":"2023-12-29T05:15:00Z","modified":"2024-02-29T07:56:27.30995Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"PYSEC-2023-257","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","status":"published","published":"2023-12-29T05:15:00Z","modified":"2024-02-29T07:56:27.30995Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"PYSEC-2023-258","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","status":"published","published":"2023-12-29T05:15:00Z","modified":"2024-02-29T07:56:27.30995Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"PYSEC-2023-259","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","status":"published","published":"2023-12-29T05:15:00Z","modified":"2024-02-29T07:56:27.30995Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"UBUNTU-CVE-2023-7152","description":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","status":"published","published":"2023-12-29T05:15:00Z","modified":"2026-10-17T12:55:59.907743574Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:41.555387Z"}]}}