Deserialization Vulnerability in Pytorch RPC Framework by Pytorch
CVE-2024-7804
Key Information:
- Vendor
Pytorch
- Status
- Vendor
- CVE Published:
- 20 March 2025
Badges
What is CVE-2024-7804?
A deserialization vulnerability exists in Pytorch's RPC framework, specifically in the torch.distributed.rpc module. The flaw stems from inadequate security verifications during the deserialization of PythonUDF objects, potentially enabling malicious actors to execute arbitrary code remotely. By sending a carefully crafted serialized PythonUDF object, an attacker could gain unauthorized access to the master node. This vulnerability highlights the importance of implementing stringent security checks during the deserialization process to mitigate risks associated with remote code execution.
Affected Version(s)
pytorch/pytorch <= unspecified
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.