Out-of-bounds read in onnx - CVE-2024-27319
Published: March 21, 2024 / Updated: March 26, 2024
Vulnerability identifier: #VU87690
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-27319
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition caused by an off-by-one error in the ONNX_ASSERT and ONNX_ASSERTM functions. A remote attacker can send specially crafted request to the application, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.
Affected software
onnx
Python for Scientific Computing
Fedora
onnx
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Python for Scientific Computing
Fedora
onnx
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
How to mitigate CVE-2024-27319
Install updates from vendor's website.
onnx - update to 1.16.0
Python for Scientific Computing - update to 4.2.1
onnx - addressed in versions 1.14.0-9.fc39, 1.14.1-2.fc40
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.1
Python for Scientific Computing - update to 4.2.1
onnx - addressed in versions 1.14.0-9.fc39, 1.14.1-2.fc40
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.1