Open Source AI framework may be a security risk!

SCMagazine.com reported “An active attack targeting a vulnerability in Ray, a widely used open-source AI framework, has impacted thousands of companies and servers running AI infrastructure — computing resources that were exposed to the attack through a critical vulnerability that’s under dispute and has no patch.”  The March 26, 2024 article entitled “Flaw in Ray AI framework potentially leaks sensitive data of workload” (https://www.scmagazine.com/news/flaw-in-ray-ai-framework-potentially-leaks-sensitive-data-of-workloads) included these comments:

 Oligo researchers said in a March 26 blog post that the bug lets attackers take over a company’s computing power and leak sensitive data. The flaw — CVE-2023-48022 — has been under active exploitation for the last seven months, affecting sectors such as education, cryptocurrency, and medical and video analytics companies.  

Here’s how the situation developed: Late last year, the researchers said five unique vulnerabilities in Ray were disclosed to unified compute platform Anyscale, the developers and Ray maintainers. The vulnerabilities were disclosed by Bishop Fox, Bryce Bearchell and Protect AI.

Following the disclosure, Anyscale posted a blog that addressed the vulnerabilities, clarified the chain of events, and detailed how each CVE was addressed. While four of the reported vulnerabilities were fixed in Ray version 2.8.1, the fifth CVE (CVE-2023-48022) remains disputed, meaning that it was not considered a risk and was not addressed with a patch.

How do you feel about Open Source AI?