TorchServe Fixes Vulnerability in PyTorch Inference Deep Learning Containers

CVE-2024-35199

Summary

TorchServe, a tool designed for serving and scaling PyTorch models in production, contains a vulnerability that exposes its gRPC ports 7070 and 7071 to all interfaces by default. This misconfiguration can allow unauthorized access to the service, which could potentially lead to exploitation. Users operating with versions of TorchServe prior to 0.11.0 should prioritize upgrading to the latest version, as this release includes patches that resolve the vulnerability. It is important to note that the default settings do not bind these ports to localhost, heightening the risk for systems that are not adequately secured. Customers leveraging PyTorch inference Deep Learning Containers (DLC) through services like Amazon SageMaker and EKS are not impacted by this issue. There are currently no known workarounds, making an upgrade essential for maintaining security.

References