PT-2024-15939 · Unknown · Cloudpickle+1

Bayuncao · Published 2024-01-27 · Updated 2024-05-17 · CVE-2024-0959

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions StanfordVL GibsonEnv version 0.3.1

Description A critical issue has been found, affecting the cloudpickle.load function of the file gibsonutilspposgd fuse.py. This issue leads to deserialization and can be exploited remotely. The complexity of an attack is rather high, and the exploitability is difficult. The exploit has been disclosed to the public and may be used.

Recommendations For StanfordVL GibsonEnv version 0.3.1, consider disabling the cloudpickle.load function as a temporary workaround until a patch is available. Restrict access to the gibsonutilspposgd fuse.py file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-0959

Affected Products

Stanfordvl Gibsonenv

Cloudpickle

References · 9

• 🔥❌ https://github.com/bayuncao/vul-cve-7/blob/main/dataset.pkl · Exploit, Deleted
• 🔥❌ https://github.com/bayuncao/vul-cve-7 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2024-0959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0959 · Security Note
• https://twitter.com/CVEnew/status/1751193249296044088 · Twitter Post
• https://vuldb.com/?id.252204 · Note
• https://t.me/cvenotify/69003 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1751239167437054201 · Twitter Post
• https://vuldb.com/?ctiid.252204 · Note