by Kastro
Paper/Archive/CVE-2024-48063

CVE-2024-48063

pytorch pytorch — In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE.

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
55
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 76.0.760 × 2015.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
pytorch≤ 2.4.1–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refrumbling-slice-eb0.notion.site/Distributed-RPC-Framework-RemoteModule-has-Deserialization-RCE-in-pytorch-pytorch-111e3cda9e8c8021a7d3cbc61ee1a20crefgist.github.com/hexian2001/c046c066895a963ecc0a2cf9e1180065refgithub.com/pytorch/pytorch/issues/129228refgithub.com/pytorch/pytorch/security/policy#using-distributed-features