CVE-2024-9052: Remote Code Execution by Pickle Deserialization in vllm-project/vllm
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Other sources
vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recvobject() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9052?
CVE-2024-9052 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-9052?
To fix CVE-2024-9052, it is recommended to update to vllm version 0.6.1 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2024-9052?
CVE-2024-9052 is a remote code execution vulnerability caused by the unsafe deserialization of object data.
Which software is affected by CVE-2024-9052?
CVE-2024-9052 affects vllm-project vllm versions prior to 0.6.1.
What function in vllm is vulnerable according to CVE-2024-9052?
The vulnerable function in vllm is vllm.distributed.GroupCoordinator.recv_object(), which uses pickle.loads() without sanitization.