Furitaanka amni darro culus ayaa lagu soo bandhigay qaab-dhismeedka Llama ee Meta, kaasoo suurtagal ka dhigi kara in weeraryahannadu si xor ah koodh uga fulin karaan server-ka inference ee llama-stack. Khaladkan oo loo yaqaan CVE-2024-50050, wuxuu helay dhibco CVSS ah 6. 3 oo ka timid Meta, halka shirkadda ammaanka silsiladda Snyk ay u aragto mid halis ah oo leh dhibco 9. 3. Sida uu sheegay Avi Lumelsky, cilmi-baare ka socda Oligo Security, noocyada ay khuseyso Llama Meta waa kuwo u nugul sidii loo deserialized gareyn lahaa xog aan la aaminin, taasoo u oggolaaneysa weeraryahanada inay diran xog waxyeelo leh oo la deserialized gareyn karto si loo fuliya koodh xaaraani ah. Amni darradan waxay la xiriirtaa fulinta koodh fog oo ku jira API-ga Python Inference, kaasoo si otomatig ah u deserialized gareeya walxaha Python iyada oo la adeegsanayo maktabadda pickle—taas oo loo arko mid khatar ah marka la ilaalinayo xog aan la aaminin. Weeraryahanadu waxay ka faa'iidaysan karaan qaladkan haddii ZeroMQ socket, oo loo isticmaalo horumarinta barnaamijyada AI ee qaababka Llama Meta, lagu muujiyo shabakadda. Iyadoo la dirayo walxo waxyeelo leh oo si habboon loo soo saaray, weeraryahan wuxuu gaari karaa fulinta koodhka mashiinka martida ah iyada oo loo marayo howlgalka unpickle. Kadib markii si mas'uuliyad leh loo shaaciyey 24-ka Sebtembar 2024, Meta waxay sixday arrintan 10-ka Oktoobar iyada oo u cusbooneysiisay nooca 0. 0. 41 iyo ka beddelidda pickle oo loo adeegsaday JSON is-dhaafsiga socket.

Tani maahan amni darro deserialization oo kaliya oo la diiwaangeliyey barnaamijyada AI; tusaale ahaan, arrin la mid ah ayaa laga helay qaab-dhismeedka Keras ee TensorFlow. Bayaanka ku saabsan amni darradan ayaa waxa uu la jaanqaaday warbixin kale oo ku saabsan qalad kale oo ku jira taranka OpenAI ee ChatGPT, kaasoo suurtagal ka dhigi kara in la fuliya weerarro DDoS ah sababo la xiriira maareyn xumo oo ku saabsan codsiyada HTTP POST. Khasaarahaani wuxuu u oggolaanayaa weeraryahanada inay diran isku xiraalado badan hal codsi gudahood, iyagoo si xad dhaaf ah u buuxiya goobta la beegsanayo oo leh xiriiryo badan. Intaas waxaa sii dheer, warbixin ka timid Truffle Security ayaa iftiimisay in qaar ka mid ah caawiyeyaasha koodhka AI ay si aan ula socon ay u soo jeedin karaan dhaqan aan amni ahayn, sida xafidan API keys, taasoo halis galinaysa ammaanka mashaariicda isticmaalaasha. Joe Leon, cilmi-baare amni, ayaa xusay in xogta tababarka ee LLM-yada ay ku jiraan dhaqanno koodh aan amni ahayn oo badan, taasoon sii wadaysa амни darrada. Intaa waxaa dheer, cilmi-baaristu waxay muujineysaa in LLM-yadu lagu isticmaali karo heerar kala duwan oo weerarrada cyber, taasoo ka dhigaysa khataraha kuwo waxtar leh oo sax ah. Cilmi-baaris ku saabsan farsamooyinka aqoonsiga moodalka AI, sida ShadowGenes, ayaa muujinaya habab cusub oo lagu raadinayo dhaxalka moodalka iyada oo la adeegsanayo falanqaynta shabakadda xisaabeed. HiddenLayer ayaa adkeysay in fahamka qoysaska moodalka AI ee hay'aduhu kor u qaadayo awoodaha maareynta ammaanka.