Red Hat Enterprise Linux AI ilab Model Serve best_of resource consumption

Summaryinfo

A vulnerability was found in Red Hat Enterprise Linux AI. It has been classified as problematic. The impacted element is an unknown function of the component ilab Model Serve. Performing a manipulation of the argument best_of results in resource consumption. This vulnerability is cataloged as CVE-2024-8939. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Red Hat Enterprise Linux AI (unknown version). This affects an unknown code block of the component ilab Model Serve. The manipulation of the argument best_of with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

A vulnerability was found in the ilab model serve component, where improper handling of the best_of parameter in the vllm JSON web API can lead to a Denial of Service (DoS). The API used for LLM-based sentence or chat completion accepts a best_of parameter to return the best completion from several options. When this parameter is set to a large value, the API does not handle timeouts or resource exhaustion properly, allowing an attacker to cause a DoS by consuming excessive system resources. This leads to the API becoming unresponsive, preventing legitimate users from accessing the service.

It is possible to read the advisory at access.redhat.com. This vulnerability is uniquely identified as CVE-2024-8939 since 09/17/2024. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/31/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-2887). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Red Hat

Name

• Enterprise Linux AI

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion