IBM Watson Speech Services race condition denial of service (CVE-2024-49353)
IBM disclosed a race condition vulnerability in Watson Speech Services Cartridge for IBM Cloud Pak for Data versions 4.0.0-5.0.2 that could cause service crashes and denial of service. IBM released a fix in version 5.0.3.
What happened
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data versions 4.0.0 through 5.0.2 contained a race condition vulnerability due to failure to properly check inputs to resources used concurrently.
The vulnerability could lead to unexpected states and potentially cause the service to crash.
Reported impact
The race condition might result in denial of service through an unexpected crash of the affected service.
Index analysis
The vulnerability was classified as CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization.
The CVSS base score was 7.5, indicating a high-severity issue requiring network access but no authentication or user interaction.
Governance controls
IBM released version 5.0.3 on 25 November 2024 with a fix that applies to all affected versions.
No workarounds or mitigations were provided prior to the patch.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.