PT-2024-27148 · Oneflow · Oneflow

Published 2024-06-06 · Updated 2025-05-02 · CVE-2024-36742

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OneFlow version 0.9.1

Description An issue in the oneflow.scatter nd parameter allows attackers to cause a Denial of Service (DoS) when the index parameter exceeds the range of shape.

Recommendations For version 0.9.1, consider restricting the use of the oneflow.scatter nd parameter to prevent the index parameter from exceeding the range of shape until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-36742

Affected Products

Oneflow

References · 8

• https://osv.dev/vulnerability/CVE-2024-36742 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36742 · Security Note
• https://gist.github.com/Redmept1on/761f0d0d09a912b8b93e0cf8dd877e94 · Note
• https://twitter.com/VulmonFeeds/status/1798786250863780076 · Twitter Post
• https://twitter.com/CVEnew/status/1798769495693021285 · Twitter Post
• https://t.me/cvenotify/82297 · Telegram Post
• https://t.me/cvenotify/82198 · Telegram Post
• https://t.me/cvenotify/120622 · Telegram Post