CVE-2024-10190: Horovod Command Injection Vulnerability
Summary
CVE-2024-10190: Horovod Vulnerable to Command Injection. Affects horovod versions < 0.28.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Horovod is an open-source framework designed to facilitate distributed deep learning. It allows users to scale their machine learning models across multiple GPUs and machines seamlessly. The framework is widely used in conjunction with popular libraries such as TensorFlow and PyTorch. However, versions up to and including v0.28.1 have a critical vulnerability that exposes users to potential remote code execution attacks.
Vulnerability Detail
Horovod is vulnerable to unauthenticated remote code execution due to improper handling of base64-encoded data in the ElasticRendezvousHandler class. Specifically, the _put_value method calls codec.loads_base64(value), which leads to cloudpickle.loads(decoded). This flaw allows an attacker to send a malicious pickle object through a PUT request, resulting in arbitrary code execution on the server. The severity of this vulnerability is reflected in its CVSS score of 9.8, indicating a high risk to affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected service to trusted networks only, thereby minimizing the risk of exploitation until an update can be applied.
Conclusion
The Horovod package has a critical vulnerability that allows for remote code execution due to improper handling of base64-encoded data. Users are strongly advised to update to the latest version to mitigate this risk. Additionally, using tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for horovod →
FAQ
The vulnerability allows attackers to execute arbitrary code on the server, which can lead to data breaches, service disruptions, or complete system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing network restrictions to limit access to the service until a secure version can be deployed.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
The CVSS score of this vulnerability is 9.8, indicating a critical level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for horovod.
