Description
A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem of the file fastchat/model/apply_delta.py. The manipulation leads to deserialization. An attack has to be approached locally.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lm-sys | fastchat | 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.2.10, 0.2.11, 0.2.12, 0.2.13, 0.2.14, 0.2.15, 0.2.16, 0.2.17, 0.2.18, 0.2.19, 0.2.20, 0.2.21, 0.2.22, 0.2.23, 0.2.24, 0.2.25, 0.2.26, 0.2.27, 0.2.28, 0.2.29, 0.2.30, 0.2.31, 0.2.32, 0.2.33, 0.2.34, 0.2.35, 0.2.36 | — |
References
- VDB-304966 | lm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization vdb-entry technical-description
- VDB-304966 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #552755 | lm-sys FastChat v0.2.3 to v0.2.36 Deserialization third-party-advisory
- https://github.com/lm-sys/FastChat/issues/3713 issue-tracking