A deserialization vulnerability exists in the Pytorch RPC framework (torch.distributed.rpc) in pytorch/pytorch versions <=2.3.1. The vulnerability arises from the lack of security verification during the deserialization process of PythonUDF objects in pytorch/torch/distributed/rpc/internal.py. This flaw allows an attacker to execute arbitrary code remotely by sending a malicious serialized PythonUDF object, leading to remote code execution (RCE) on the master node.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Tue, 25 Mar 2025 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Thu, 20 Mar 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 20 Mar 2025 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A deserialization vulnerability exists in the Pytorch RPC framework (torch.distributed.rpc) in pytorch/pytorch versions <=2.3.1. The vulnerability arises from the lack of security verification during the deserialization process of PythonUDF objects in pytorch/torch/distributed/rpc/internal.py. This flaw allows an attacker to execute arbitrary code remotely by sending a malicious serialized PythonUDF object, leading to remote code execution (RCE) on the master node. | |
| Title | Deserialization of Untrusted Data in pytorch/pytorch | |
| Weaknesses | CWE-502 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2025-03-20T10:11:37.165Z
Updated: 2025-03-20T18:27:19.645Z
Reserved: 2024-08-14T16:45:16.341Z
Link: CVE-2024-7804
Vulnrichment
Updated: 2025-03-20T18:27:14.545Z
NVD
Status : Received
Published: 2025-03-20T10:15:37.767
Modified: 2025-03-20T10:15:37.767
Link: CVE-2024-7804
Redhat