cvelistv5 - cve-2024-9052

CVE-2024-9052 (GCVE-0-2024-9052)

Vulnerability from cvelistv5

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-04-10T16:17:38.776Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntr_ai"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
            }
          ],
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntr_ai",
    "cveId": "CVE-2024-9052",
    "datePublished": "2025-03-20T10:09:31.436Z",
    "dateRejected": "2025-04-10T16:03:38.015Z",
    "dateReserved": "2024-09-20T18:41:05.794Z",
    "dateUpdated": "2025-04-10T16:17:38.776Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-9052\",\"sourceIdentifier\":\"security@huntr.dev\",\"published\":\"2025-03-20T10:15:46.197\",\"lastModified\":\"2025-04-10T16:15:27.670\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"shortName\": \"@huntr_ai\", \"dateUpdated\": \"2025-04-10T16:17:38.776Z\"}, \"rejectedReasons\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}], \"value\": \"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-9052\", \"assignerOrgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"state\": \"REJECTED\", \"assignerShortName\": \"@huntr_ai\", \"dateReserved\": \"2024-09-20T18:41:05.794Z\", \"datePublished\": \"2025-03-20T10:09:31.436Z\", \"dateUpdated\": \"2025-04-10T16:17:38.776Z\", \"dateRejected\": \"2025-04-10T16:03:38.015Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

ghsa-pgr7-mhp5-fgjp

Vulnerability from github

Published

2025-03-20 12:32

Modified

2025-04-09 17:02

Severity ?

9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

Details

vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability.

Maintainer perspective

Note that vLLM does NOT use the code as described in the report on huntr. The problem only exists if you use these internal APIs in a way that exposes them to a network as described. The vllm team was not involved in the analysis of this report and the decision to assign it a CVE.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T03:30:38Z",
    "nvd_published_at": "2025-03-20T10:15:46Z",
    "severity": "CRITICAL"
  },
  "details": "vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recv_object() deserializes received object bytes using pickle.loads() without sanitization, leading to a remote code execution vulnerability.\n\n### Maintainer perspective\nNote that vLLM does NOT use the code as described in the report on huntr. The problem only exists if you use these internal APIs in a way that exposes them to a network as described. The vllm team was not involved in the analysis of this report and the decision to assign it a CVE.",
  "id": "GHSA-pgr7-mhp5-fgjp",
  "modified": "2025-04-09T17:02:38Z",
  "published": "2025-03-20T12:32:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9052"
    },
    {
      "type": "WEB",
      "url": "https://github.com/github/advisory-database/pull/5444"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/blob/32e7db25365415841ebc7c4215851743fbb1bad1/vllm/distributed/parallel_state.py#L480"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/blob/v0.8.1/vllm/distributed/parallel_state.py#L457"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/ea75728f-4efe-4a3d-9f53-33f2c908e9f8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object"
}

fkie_cve-2024-9052

Vulnerability from fkie_nvd

Published

2025-03-20 10:15

Modified

2025-04-10 16:15

Severity ?

Summary

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

References

▼	URL	Tags

Impacted products

	Vendor	Product	Version