CVE-2022-0315: Insecure Temporary File Usage in Horovod
Summary
CVE-2022-0315: Use of insecure temporary file in Horovod. Affects horovod versions < 0.24.0. Fixed in 0.24.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Horovod is an open-source distributed deep learning framework that enables efficient training of machine learning models across multiple GPUs and nodes. It supports popular deep learning frameworks such as TensorFlow, PyTorch, and Keras. Horovod utilizes parallelism techniques like MPI, Gloo, Spark, and Ray to accelerate model training. However, a vulnerability has been identified in Horovod that involves the insecure usage of temporary files.
Vulnerability Detail
The vulnerability (CVE-2022-0315) arises when Horovod is executed in an LSF job with jsrun. In this scenario, a jsrun rank file is created using the insecure tempfile.mktemp() function. This insecure usage of temporary files can be exploited by an attacker to read or manipulate the content of the rank file. It is important to note that this vulnerability does not affect the use of MPI, Gloo, Spark, or Ray.
How To Fix
Minimum fixed version
0.24.0
This is the first release that contains the fix.
pip install --upgrade "horovod==0.24.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a workaround is available. The rank file is not created when binding_args are provided in the Settings instance. By including binding_args in the configuration, the creation of the vulnerable rank file can be avoided.
Conclusion
The vulnerability in Horovod involving the insecure temporary file usage has been addressed in version 0.24.0. Users are advised to update their installations to the latest version to mitigate the risk. If immediate updating is not feasible, the workaround of using binding_args can be employed. For further support or assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for horovod →
FAQ
Horovod is an open-source distributed deep learning framework that enables efficient training of machine learning models across multiple GPUs and nodes. It supports popular deep learning frameworks such as TensorFlow, PyTorch, and Keras.
The vulnerability allows an attacker to read or manipulate the content of the rank file created by Horovod when running in an LSF job with jsrun. This could potentially lead to unauthorized access or tampering of the distributed training process.
No, this vulnerability only affects Horovod when it is run in an LSF job with jsrun. It does not impact the use of MPI, Gloo, Spark, or Ray.
To fix the vulnerability, update your Horovod installation to version 0.24.0 or later. This will ensure that the insecure temporary file usage is patched.
Yes, if updating to the latest version is not immediately possible, you can use the workaround of providing binding_args in the Settings instance to avoid the creation of the vulnerable rank file.
References
Related vulnerabilities
Recent vulnerabilities recorded for horovod.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
