CVE-2024-7804: Deserialization of Untrusted Data in pytorch/pytorch
Withdrawn Advisory This advisory has been withdrawn because it describes known functionality of PyTorch. This link is maintained to preserve external references.
Original Description A deserialization vulnerability exists in the Pytorch RPC framework (torch.distributed.rpc) in pytorch/pytorch versions <=2.3.1. The vulnerability arises from the lack of security verification during the deserialization process of PythonUDF objects in pytorch/torch/distributed/rpc/internal.py. This flaw allows an attacker to execute arbitrary code remotely by sending a malicious serialized PythonUDF object, leading to remote code execution (RCE) on the master node.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7804?
CVE-2024-7804 has a high severity rating due to its potential for remote code execution through deserialization vulnerabilities.
How do I fix CVE-2024-7804?
To fix CVE-2024-7804, upgrade to PyTorch version 2.3.2 or later which addresses the deserialization issue.
What versions of PyTorch are affected by CVE-2024-7804?
CVE-2024-7804 affects PyTorch versions 2.3.1 and earlier.
What is a deserialization vulnerability as seen in CVE-2024-7804?
A deserialization vulnerability occurs when untrusted data is processed and can lead to code execution or system compromise.
What components of PyTorch are impacted by CVE-2024-7804?
CVE-2024-7804 impacts the deserialization process of PythonUDF objects in the PyTorch RPC framework.