CVE-2024-0140 : NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue (24th Jan 2025)

Preface: RAPIDS™, part of NVIDIA CUDA-X, is an open-source suite of GPU-accelerated data science and AI libraries with APIs that match the most popular open-source data tools. It accelerates performance by orders of magnitude, at scale, across data pipelines.

Background: RAPIDS is an open-source suite of software libraries and frameworks developed by NVIDIA to accelerate and streamline data science and analytics workflows. One of its key components is cuDF, a GPU-accelerated DataFrame library that mirrors the functionality of Pandas but operates at much higher speeds. This allows for rapid data loading, filtering, and transformation with reduced memory usage.

cuDF: Python bindings for libcudf (Pandas like API for DataFrame manipulation)

cuML: C++/CUDA ML Algorithms: C++/CUDA machine learning algorithms

Vulnerability details: NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information.

Official announcement: Please refer to the link for details – https://nvidia.custhelp.com/app/answers/detail/a_id/5597

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.