Object deserialization RCE in Reverb (CVE-2024-8375)
A vulnerability in Google DeepMind's Reverb server allowed remote code execution through unsafe deserialization of VARIANT tensor types. Unauthenticated attackers could insert malicious tensor protobuf objects that would corrupt memory and hijack program control when unpacked by clients.
What happened
Reverb Server stores Tensors represented by protos containing type information and a 'tensor_content' string field. When the Reverb client unpacks these protos, it turns them back into tensors.
When a tensor proto of type VARIANT is unpacked, memory is allocated and a constructor is called on each instance, then Reverb copies the content from tensor_content to the pre-allocated memory, causing the bytes to overwrite vtable pointers of previously allocated objects.
The vulnerability was exposed through two unauthenticated and unauthorised gRPC endpoints: InsertStream and SampleStream. An attacker could insert a malicious tensor into the server's database, and when a client called SampleStream, unpacking would corrupt memory, and any method call on the object including its destructor would give the attacker control of the Program Counter.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.