CVE-2024-9053: Remote Code Execution in vllm-project/vllm
vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality runserverloop() calls the function makehandlercoro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9053?
CVE-2024-9053 is considered a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-9053?
To fix CVE-2024-9053, upgrade to a patched version of the vllm library that includes sanitization of inputs before handling.
What are the risks associated with CVE-2024-9053?
The risks associated with CVE-2024-9053 include remote code execution, data loss, and unauthorized system access.
What versions of vllm are affected by CVE-2024-9053?
CVE-2024-9053 affects vllm version 0.6.0 specifically.
How can I prevent exploitation of CVE-2024-9053?
To prevent exploitation of CVE-2024-9053, ensure that your application does not expose vulnerable RPC server entrypoints or use appropriate input validation techniques.