PT-2026-59121

There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance...

CVE-2024-8375 Object deserialization in Reverb leading to RCE

There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to represent an arbitrary object in C++. When a tensor proto of type VARIANT is unpacked, memory is first allocated to store the entire tensor, and a ctor is called on each instance...

CVE-2024-8375

CVE-2024-8375 affects Google DeepMind Reverb. A use-after-free vulnerability arises when unpacking a tensor proto of type VARIANT: memory is allocated for the tensor, objects are constructed, then tensor_content is copied into pre-allocated memory, overwriting vtable pointers. This enables an att...

Reverb 安全漏洞

Reverb is an efficient and easy-to-use data storage and transfer system open-sourced by Google DeepMind. Reverb has a security vulnerability that stems from when unpacking a tensor prototype of type VARIANT overwrites the bytes in tensorcontent with vtable pointers to all previously allocated...