CVE-2024-48063

The vulnerability results from unsafe deserialization of data (CWE-502) in the RemoteModule component, which is part of PyTorch's distributed computing framework. An attacker can supply crafted, malicious data to the deserialization process, which consequently leads to arbitrary code execution on the server. This mechanism is available over the network without requiring authentication or user interaction.

An attacker can gain full control over the victim's system through remote code execution (RCE), which threatens the confidentiality, integrity, and availability of the system.

Patches available from the vendor should be applied according to the references. The vendor indicates in its security policy that PyTorch distributed functions are intended solely for use in trusted network environments — distributed computing interfaces should not be exposed to untrusted networks. It is recommended to review the PyTorch security documentation regarding distributed functions.

PyTorch (Linuxfoundation) in versions up to and including 2.4.1, that utilize distributed computing features (RemoteModule / Distributed RPC Framework).