CVE-2024-48063
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-48063
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-48063.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-48063
- Related
- Withdrawn
- 2024-11-01T13:05:45Z
- Published
- 2024-10-29T21:15:04Z
- Modified
- 2024-12-29T04:48:24.831473Z
- Summary
- [none]
- Details
-
In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
- References
-
- https://github.com/pytorch/pytorch/issues/129228
- https://gist.github.com/hexian2001/c046c066895a963ecc0a2cf9e1180065
- https://github.com/pytorch/pytorch/security/policy#using-distributed-features
- https://rumbling-slice-eb0.notion.site/Distributed-RPC-Framework-RemoteModule-has-Deserialization-RCE-in-pytorch-pytorch-111e3cda9e8c8021a7d3cbc61ee1a20c
- https://security-tracker.debian.org/tracker/CVE-2024-48063
Affected packages
Debian:11 / pytorch
Package
- Name
- pytorch
- Purl
- pkg:deb/debian/pytorch?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
1.*
1.7.1-7
1.8.1-1
1.8.1-2
1.8.1-3
1.8.1-4
1.8.1-5
1.12.0~rc1-1
1.12.0-1
1.12.1-1
1.13.1+dfsg-1
1.13.1+dfsg-2
1.13.1+dfsg-3
1.13.1+dfsg-4
1.13.1+dfsg-5
2.*
2.0.1+dfsg-1~exp1
2.0.1+dfsg-1
2.0.1+dfsg-2
2.0.1+dfsg-4
2.0.1+dfsg-5
2.1.2+dfsg-1
2.1.2+dfsg-2
2.1.2+dfsg-4
2.4.1-1
2.4.1-3
2.4.1-4
2.5.0+dfsg-1
2.5.1+dfsg-1
2.5.1+dfsg-3
Debian:12 / pytorch
Package
- Name
- pytorch
- Purl
- pkg:deb/debian/pytorch?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:13 / pytorch
Package
- Name
- pytorch
- Purl
- pkg:deb/debian/pytorch?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected