{"id":"CVE-2023-7152","summary":"MicroPython modselect.c poll_set_add_fd use after free","details":"A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.","aliases":["PYSEC-2023-256","PYSEC-2023-257","PYSEC-2023-258","PYSEC-2023-259"],"modified":"2026-08-12T15:14:56.625234Z","published":"2023-12-29T04:31:04.054Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7152.json","cna_assigner":"VulDB","cwe_ids":["CWE-416"]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4E2HYWCZB5R4SHY4SZZZSFDMD64N4SOZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D3WWY5JY4RTJE25APB4REGDUDPATG6H7/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEK46QAJOXXDZOWOIE2YACUOCZFWOBCK/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7152.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7152"},{"type":"ADVISORY","url":"https://vuldb.com/?id.249158"},{"type":"REPORT","url":"https://github.com/micropython/micropython/issues/12887"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.249158"},{"type":"FIX","url":"https://github.com/jimmo/micropython/commit/8b24aa36ba978eafc6114b6798b47b7bfecdca26"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jimmo/micropython","events":[{"introduced":"0"},{"fixed":"8b24aa36ba978eafc6114b6798b47b7bfecdca26"}],"database_specific":{"source":"REFERENCES"}},{"type":"GIT","repo":"https://github.com/micropython/micropython","events":[{"introduced":"e00a144008f368df878c12606fdbf651af2a1dc0"},{"last_affected":"69e34b6b6bdf45bc1111777c46839a8b5fcb30bd"}],"database_specific":{"cpe":["cpe:2.3:a:micropython:micropython:1.21.0:*:*:*:*:*:*:*","cpe:2.3:a:micropython:micropython:1.22.0:preview:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.21.0"},{"last_affected":"1.21.0"},{"introduced":"1.22.0-preview"},{"last_affected":"1.22.0-preview"}],"source":["AFFECTED_FIELD","CPE_STRING"]}}],"versions":["1.21.0","1.22.0-preview","v1.9.3","v1.9.2","v1.9.1","v1.9","v1.8.7","v1.8.6","v1.8.5","v1.8.4","v1.8.3","v1.8.2","v1.8.1","v1.8","v1.7","v1.6","v1.5.2","v1.5.1","v1.5","v1.4.6","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.4.1","v1.4","v1.3.10","v1.3.9","v1.3.8","v1.3.7","v1.3.6","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3","v1.2","v1.1.1","v1.1","v1.0.1","v1.0","v1.0-rc1","v1.22.0-preview","v1.21.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-7152.json","vanir_signatures_modified":"2026-08-12T15:14:56Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jimmo/micropython/commit/8b24aa36ba978eafc6114b6798b47b7bfecdca26","target":{"file":"extmod/modselect.c"},"deprecated":false,"digest":{"line_hashes":["100514678993952764631001232513906537474","184635985177277776058266799635677985380","164230940075714143062822397552674040199","228660635332080749222774965009048948408","28995778423837000612302589737259141075","18652610911259546864168799773277061273","286860532521091533751639708115663559090","224462232164678787202293072350156611568","240308530618914926892437594634708463221","84432039754077587633886216482598820342","268424210313647838700403150769473988174","321210418996263357512097437121534983644"],"threshold":0.9},"id":"CVE-2023-7152-25f6c61c"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jimmo/micropython/commit/8b24aa36ba978eafc6114b6798b47b7bfecdca26","target":{"file":"extmod/modselect.c","function":"poll_set_add_fd"},"deprecated":false,"digest":{"function_hash":"160868559766814285633166252859406262810","length":591},"id":"CVE-2023-7152-b41c5cce"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}