CVE-2024-11041: Remote Code Execution in vllm-project/vllm
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets directly, leading to a remote code execution vulnerability. An attacker can exploit this by sending a malicious payload to the MessageQueue, causing the victim's machine to execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11041?
CVE-2024-11041 has been classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-11041?
To fix CVE-2024-11041, update the vllm package to version 0.6.3 or later, which addresses this vulnerability.
What types of attacks can exploit CVE-2024-11041?
CVE-2024-11041 can be exploited through remote code execution attacks by sending malicious payloads via the insecure MessageQueue.dequeue() API.
Which version of vllm is affected by CVE-2024-11041?
CVE-2024-11041 affects vllm version 0.6.2 and prior versions.
Is CVE-2024-11041 exploitable without authentication?
Yes, CVE-2024-11041 is exploitable without authentication, allowing unauthorized attackers to execute code remotely.