PT-2025-12116 · Open Mmlab · Open-Mmlab/Mmdetection

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-12044

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions open-mmlab/mmdetection version v3.3.0

Description A remote code execution issue exists due to the use of the pickle.loads() function in the all reduce dict() distributed training API without proper sanitization, allowing an attacker to execute arbitrary code by broadcasting a malicious payload to the distributed training network.

Recommendations For open-mmlab/mmdetection version v3.3.0, consider disabling the use of the pickle.loads() function in the all reduce dict() API until a patch is available, or restrict access to the distributed training network to minimize the risk of exploitation.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-12044

Affected Products

Open-Mmlab/Mmdetection

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-12044 · Security Note
• https://huntr.com/bounties/f7e4fc32-e167-49fb-9fc7-f092b9c27e8a · Note
• https://twitter.com/CVEnew/status/1902968845725470809 · Twitter Post