CVE-2022-0315
📋 TL;DR
CVE-2022-0315 is an insecure temporary file vulnerability in Horovod, a distributed deep learning framework. It allows local attackers to create or overwrite arbitrary files via symlink attacks due to predictable temporary file names. This affects users of Horovod versions prior to 0.24.0.
💻 Affected Systems
- Horovod
📦 What is this software?
Horovod by Horovod
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to complete system compromise, data corruption, or denial of service by overwriting critical system files.
Likely Case
Local user gains unauthorized access to sensitive data or disrupts Horovod operations by manipulating temporary files.
If Mitigated
Minimal impact if proper file permissions and isolation are enforced, limiting damage to the user's own files.
🎯 Exploit Status
Exploitation requires local access to the system. The vulnerability is well-documented with proof-of-concept available in the commit and bounty reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.24.0 and later
Vendor Advisory: https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41
Restart Required: No
Instructions:
1. Update Horovod to version 0.24.0 or later using pip: 'pip install --upgrade horovod>=0.24.0'. 2. Verify the installation with 'pip show horovod'. 3. No restart is required as this is a library update.
🔧 Temporary Workarounds
Secure temporary directory
linuxSet the TMPDIR environment variable to a secure, user-isolated directory to prevent symlink attacks.
export TMPDIR=$(mktemp -d)
Restrict file permissions
linuxEnsure Horovod runs with minimal privileges and temporary directories have strict permissions.
chmod 700 /tmp/horovod_temp
mkdir -p /tmp/horovod_temp
🧯 If You Can't Patch
- Run Horovod in isolated containers or virtual machines to limit the impact of local file manipulation.
- Implement strict access controls and monitor for unusual file creation in temporary directories.
🔍 How to Verify
Check if Vulnerable:
Check Horovod version with 'pip show horovod' or 'python -c "import horovod; print(horovod.__version__)"'. If version is below 0.24.0, it is vulnerable.Check Version:
pip show horovod | grep VersionVerify Fix Applied:
After updating, confirm version is 0.24.0 or higher using the same commands. Test by running Horovod and checking that temporary files are created securely.📡 Detection & Monitoring
Log Indicators:
- Unusual file creation or modification in /tmp or temporary directories by Horovod processes
- Errors related to file permissions or symlinks in Horovod logs
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
process.name:"horovod" AND file.path:"/tmp/*" AND event.action:"create" OR event.action:"modify"