CVE-2024-10190: Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod
Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the ElasticRendezvousHandler, a subclass of KVStoreHandler. Specifically, the putvalue method in ElasticRendezvousHandler calls codec.loadsbase64(value), which eventually invokes cloudpickle.loads(decoded). This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10190?
CVE-2024-10190 has a critical severity rating due to its potential for unauthenticated remote code execution.
How do I fix CVE-2024-10190?
You can fix CVE-2024-10190 by upgrading to Horovod version 0.28.2 or later.
What versions are affected by CVE-2024-10190?
CVE-2024-10190 affects all Horovod versions up to and including 0.28.1.
What causes CVE-2024-10190?
CVE-2024-10190 is caused by improper handling of base64-encoded data in the ElasticRendezvousHandler.
Can CVE-2024-10190 lead to data breaches?
Yes, CVE-2024-10190 can potentially lead to data breaches as it allows remote code execution without authentication.