PT-2025-12028 · Horovod · Horovod

Published 2025-03-20 · Updated 2025-12-11 · CVE-2024-10190

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Horovod versions up to and including v0.28.1

Description The issue is due to improper handling of base64-encoded data in the ElasticRendezvousHandler, a subclass of KVStoreHandler. Specifically, the put value method in ElasticRendezvousHandler calls codec.loads base64(value), which eventually invokes cloudpickle.loads(decoded). This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.

Recommendations For Horovod versions up to and including v0.28.1, consider disabling the ElasticRendezvousHandler or restricting access to the put value method until a patch is available. Avoid using the codec.loads base64(value) function in the affected ElasticRendezvousHandler class to minimize the risk of exploitation.

Exploit

Fix

RCE

Command Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-77

CWE-502

Related Identifiers

CVE-2024-10190

GHSA-MRHH-3GGQ-23P2

Affected Products

Horovod

References · 7

• 🔥 https://huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754 · Exploit
• https://osv.dev/vulnerability/GHSA-mrhh-3ggq-23p2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10190 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10190 · Vendor Advisory
• https://github.com/horovod/horovod · Note
• https://t.me/cveNotify/145485 · Telegram Post
• https://twitter.com/CVEnew/status/1902968862116811256 · Twitter Post