CVE-2024-9052

描述

vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability. ### Maintainer perspective Note that vLLM does NOT use the code as described in the report on huntr. The problem only exists if you use these internal APIs in a way that exposes them to a network as described. The vllm team was not involved in the analysis of this report and the decision to assign it a CVE.

如何修補 CVE-2024-9052

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2024-9052 正在被利用嗎?

目前沒有被利用訊號。CVE-2024-9052 既不在 CISA KEV 也沒有最新的 EPSS 分數。

受影響套件(1)

• from 0, <= 0.8.1

CVSS 分數

參考連結(8)

• ADVISORYgithub.com/advisories/GHSA-pgr7-mhp5-fgjp
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-9052
• PATCHgithub.com/vllm-project/vllm
• PATCHpypi.org/project/vllm
• WEBgithub.com/github/advisory-database/pull/5444