CVE-2024-10190 Information

Description

Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the ElasticRendezvousHandler a subclass of KVStoreHandler. Specifically the _put_value method in ElasticRendezvousHandler calls codec.loads_base64(value) which eventually invokes cloudpickle.loads(decoded). This allows an attacker to send a malicious pickle object via a PUT request leading to arbitrary code execution on the server.

Reference

https://huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754