CVE-2022-24294 ReDoS in Apache MXNet RTC Module
Attackers can cause denial of service in Apache MXNet by loading models with specially crafted operator names that trigger excessive resource consumption in regular expressions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24294?
CVE-2022-24294 is a high-severity denial of service vulnerability in Apache MXNet, published on 24 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be exploited when loading a model in Apache MXNet that has a specially crafted operator name that would cause the regular expression evaluation to use excessive resources to attempt a match. This issue affects Apache MXNet versions prior to 1.9.1.
Weakness: CWE-400
Which versions are affected by CVE-2022-24294?
4 open source packages ship an affected version, including mxnet. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mxnet Bitnami | All versions | 1.9.1 |
mxnet PyPI | All versions | 1.9.1 |
mxnet PyPI | All versions | 1.9.1 |
mxnet PyPI | All versions | 1.9.1 |
Products include Apache Mxnet.
How do I fix CVE-2022-24294?
Upgrade mxnet to 1.9.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-24294 being exploited?
There is no known exploitation of CVE-2022-24294 in the wild and no public exploit code.
Other vulnerabilities in Apache MXNet
Sources
Also known as BIT-mxnet-2022-24294, GHSA-xxj3-55p6-xg3h, PYSEC-2026-850.