by Kastro
Paper/Archive/CVE-2024-10190

CVE-2024-10190

horovod horovod/horovod — Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.3.663 × 2013.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.

Affected

ProductAffectedFixed inSource
horovod/horovodunspecified – latest–CNA

Scores by source

@huntr_ai (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhuntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754