Disclosed weakness · no CVE recorded

GPUStack could accept routing claims from the wrong worker

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

A worker could claim a route intended for a trusted peer and disrupt or redirect proxied connections.

Severity and exploitation evidence

High · 8.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Proxy route registration did not sufficiently distinguish ordinary workers from trusted federation peers.

Conditions required

A caller has valid worker authentication and access to the affected proxy.

Potential impact

Affected connections could be redirected or interrupted. Confidentiality also depends on end-to-end peer authentication and encryption.

Affected versions and configurations

>= 2.2.0, < 2.3.0

Fix and mitigation status

2.3.0 fixes this issue.

Practical next steps

Upgrade to 2.3.0 or a later release containing this fix. Review worker identities and routing registrations as well as encryption between peers.

Operating lesson

Require independent authorization for route ownership.

Evidence and limits

GPUStack shipped 2.3.0 on October 23. GitHub records an edit to the release notes on October 26, when GPUStack published the dated advisory. No CVE was listed in the advisory at review.

Sources