CVE-2024-48063: PyTorch RPC Framework Remote Code Execution
CVE-2024-48063 is a deserialization vulnerability in PyTorch's Distributed RPC Framework affecting versions 2.4.1 and earlier. The flaw in the rpc.remote function and RemoteModule allows attackers to execute arbitrary code on nodes in distributed systems through malicious payloads.
What happened
PyTorch versions 2.4.1 and earlier contain a vulnerability in the Distributed RPC Framework, specifically in the rpc.remote function and RemoteModule component.
The vulnerability is a deserialization flaw in torch/distributed/rpc/internal.py that allows remote code execution through malicious payloads sent to the RPC framework.
Reported impact
Attackers who can post malicious payloads to the RPC framework can execute arbitrary code on affected nodes in a distributed system.
Index analysis
The vulnerability involves a serialization attack vector through the rpc.remote function, which is used for creating remote object references and invoking methods across distributed processes or nodes.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.