Skip to main content

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2024-47870

High
8.1/10

Summary

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a race condition in the "update_root_in_config" function, allowing an attacker to modify the "root" URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Users are advised to upgrade to address this issue. There are no known workarounds for this issue. This issue affects versions prior to 5.0.0.

  • HIGH
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-362 - Race Condition

A race condition occurs in a shared memory program when two threads/processes access the same shared memory data, and at least one thread executes a write operation. This vulnerability manipulates the time to check vs. time to use (TOC/TOU) gap between the threads in the critical section to cause disorientation in the shared data. The impact can vary from compromising the confidentiality of the system to causing the system to crash or to execute arbitrary code.

References

Advisory Timeline

  • Published