CVE-2022-0315: Insecure Temporary File in horovod/horovod
Impact The insecure tempfile.mktemp() is used when Horovod is run in an LSF job with jsrun. In that situation, a jsrun rank file is created with mktemp, which could be hijacked by another process to read or manipulate the content.
This issue does not impact the use of MPI, Gloo, Spark or Ray.
Patches The problem has been fixed in b96ecae4.
Workarounds The rank file is not created when bindingargs are provided in the Settings instance.
References Please see https://github.com/horovod/horovod/pull/3358 for details.
For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/horovod/horovod
Other sources
Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0315?
CVE-2022-0315 has a medium severity rating due to the potential for process hijacking.
How do I fix CVE-2022-0315?
To fix CVE-2022-0315, update Horovod to version 0.24.0 or later.
What impact does CVE-2022-0315 have on Horovod users?
CVE-2022-0315 allows unauthorized processes to read or manipulate files created by the insecure use of tempfile.mktemp(), posing a risk in LSF job environments.
Which versions of Horovod are affected by CVE-2022-0315?
All versions of Horovod prior to 0.24.0 are affected by CVE-2022-0315.
What should I do if I can't upgrade to version 0.24.0 to mitigate CVE-2022-0315?
If upgrading is not possible, consider implementing additional security measures to restrict access to the temporary files created during LSF jobs.