Denial of Service in aimhubio/aim

Vulnerability

Description

CVE-2024-12777 affects aimhubio/aim version 3.25.0. The tracking server is single-threaded and uses the sshfs-client to mount remote filesystems. The sshfs-client lacks a configurable timeout, causing the server to hang indefinitely when attempting to connect to an unresponsive socket [1][2]. This is a classic resource exhaustion vulnerability.

Exploitation

An attacker who can send a request to the tracking server can trigger the hang by requesting a connection to an unresponsive socket via sshfs. The single-threaded nature of the server means that while the connection attempt hangs, the server cannot process any other requests [2]. No special privileges are required beyond the ability to interact with the server's API.

Impact

Successful exploitation results in a denial of service (DoS). The tracking server becomes unresponsive, interrupting experiment tracking and rendering the service unavailable to legitimate users [4]. There is no confidentiality or integrity impact.

Mitigation

Status

Currently, no patch is available in the referenced sources [3]. Users should monitor the vendor's repository for updates and consider implementing a timeout or limiting sshfs requests as a workaround [1][4].