Description
In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://rumbling-slice-eb0.notion.site/Distributed-RPC-Framework-RemoteModule-has-Deserialization-RCE-in-pytorch-pytorch-111e3cda9e8c8021a7d3cbc61ee1a20c ↗
- https://gist.github.com/hexian2001/c046c066895a963ecc0a2cf9e1180065 ↗
- https://github.com/pytorch/pytorch/issues/129228 ↗
- https://github.com/pytorch/pytorch/security/policy#using-distributed-features ↗