gpustack

What this is

gpustack manages graphics processors for running models and providing computing resources. It can mistake a request sent over the network for a local request and grant administrator access without checking who sent it.

How it can harm you

Someone who can reach gpustack over the network can gain administrator access without signing in if their request is mistaken for a local one and local identity checks are disabled, as they are by default. They can change users and models, create lasting administrator access keys, expose worker and cloud provider secrets, and run their own program on the server.

How urgent it is

This vulnerability is already being used in attacks. Update promptly because the flaw can let someone gain administrator access without signing in.

Who is affected

gpustack versions before 2.2.0 are affected.

What to do

Update gpustack to 2.2.0, which fixes this issue. Consult the vendor advisory for verified update instructions.

How to check your server

Check which version of gpustack is installed and compare it with the affected versions and fixed release listed in the vendor advisory.

Check your server for free →