CVE-2024-12044 — Remote Code Execution by Pickle Deserialization in open-mmlab/mmdetection

CVE-2024-12044

Remote Code Execution by Pickle Deserialization in open-mmlab/mmdetection PUBLISHED

Description (CNA)

A remote code execution vulnerability exists in open-mmlab/mmdetection version v3.3.0. The vulnerability is due to the use of the `pickle.loads()` function in the `all_reduce_dict()` distributed training API without proper sanitization. This allows an attacker to execute arbitrary code by broadcasting a malicious payload to the distributed training network.

Affected (CNA)

Vendor / product	Versions
open-mmlab / open-mmlab/mmdetection	affected unspecified through latest

CWE

CWE-502

References

https://huntr.com/bounties/f7e4fc32-e167-49fb-9fc7-f092b9c27e8a

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.