CVE-2024-12044

Name of the Vulnerable Software and Affected Versions open-mmlab/mmdetection version v3.3.0

Description A remote code execution issue exists due to the use of the pickle.loads() function in the all reduce dict() distributed training API without proper sanitization, allowing an attacker to execute arbitrary code by broadcasting a malicious payload to the distributed training network.

Recommendations For open-mmlab/mmdetection version v3.3.0, consider disabling the use of the pickle.loads() function in the all reduce dict() API until a patch is available, or restrict access to the distributed training network to minimize the risk of exploitation.