CVE-2024-8375

There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance. Afterwards, Reverb copies the content in tensor_content to the previously mentioned pre-allocated memory, which results in the bytes in tensor_content overwriting the vtable pointers of all the objects which were previously allocated. Reverb exposes 2 relevant gRPC endpoints: InsertStream and SampleStream. The attacker can insert this stream into the server’s database, then when the client next calls SampleStream they will unpack the tensor into RAM, and when any method on that object is called (including its destructor) the attacker gains control of the Program Counter. We recommend upgrading past git commit  https://github.com/google-deepmind/reverb/commit/6a0dcf4c9e842b7f999912f792aaa6f6bd261a25

• CWE-502
• CWE-416
• CWE-502

• https://github.com/google-deepmind/reverb/commit/6a0dcf4c9e842b7f999912f792aaa6f6bd261a25Patch
• https://github.com/google-deepmind/reverb/issues/141Issue Tracking, Patch

Published

Sep 19, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8369The EventPrime – Events Calendar, Bookings and Tickets plugi…5.3
• CVE-2024-8370A vulnerability classified as problematic was found in Grocy…5.4
• CVE-2024-8371Rejected reason: Duplicate of CVE-2024-45305.
• CVE-2024-8372Improper sanitization of the value of the 'srcset' attribute…4.3
• CVE-2024-8373Improper sanitization of the value of the [srcset] attribute…4.3
• CVE-2024-8374UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 ar…7.8
• CVE-2024-8376In Eclipse Mosquitto up to version 2.0.18a, an attacker can …7.5
• CVE-2024-8377Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-8378The Safe SVG WordPress plugin before 2.2.6 has its sanitisat…4.8
• CVE-2024-8379The Cost Calculator Builder WordPress plugin before 3.2.29 d…7.2
• CVE-2024-8380A vulnerability was found in SourceCodester Contact Manager …9.8
• CVE-2024-8381A potentially exploitable type confusion could be triggered …9.8