CVE-2024-10372
📋 TL;DR
This vulnerability in the buzz library allows local attackers to manipulate temporary files created during model downloads, potentially leading to file overwrites or symlink attacks. It affects users of buzz 1.1.0 who download models via the vulnerable function. The attack requires local access and high complexity.
💻 Affected Systems
- chidiwilliams buzz
📦 What is this software?
Buzz by Chidiwilliams
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation or arbitrary file overwrite leading to system compromise
Likely Case
Local user could overwrite temporary files or create symlinks to sensitive files
If Mitigated
Minimal impact with proper file permissions and isolation
🎯 Exploit Status
Exploit disclosed publicly but requires local access and specific conditions
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or alternative libraries.
🔧 Temporary Workarounds
Secure temporary directory
linuxSet secure permissions on temporary directories and use secure temp file creation
chmod 700 /tmp/buzz_temp
mkdir -p /tmp/buzz_temp && chmod 700 /tmp/buzz_temp
Avoid model downloads
allDisable or avoid using the download_model function
🧯 If You Can't Patch
- Restrict local user access to systems running buzz
- Implement strict file permission controls and monitor temporary file operations
🔍 How to Verify
Check if Vulnerable:
Check if using buzz version 1.1.0: pip show buzz | grep VersionCheck Version:
pip show buzz | grep VersionVerify Fix Applied:
Verify buzz is not version 1.1.0 or check if temporary file handling is secure📡 Detection & Monitoring
Log Indicators:
- Unusual file operations in /tmp directories
- Multiple temporary file creations by buzz processes
Network Indicators:
- Local file system access patterns
SIEM Query:
Process creation where command contains 'buzz' AND file operations in temporary directories