Medium WID-SEC-2024-0922 2 CVEs

PyTorch: Mehrere Schwachstellen ermöglichen Denial of Service

Published Apr 17, 2024 · Updated Aug 12, 2024 · Revision 2 · de-DE

Vendor: Splunk Product: Splunk Enterprise Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in PyTorch ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

PyTorch ist eine Tensor-Bibliothek für Deep Learning mit GPUs und CPUs.

Vulnerabilities 2

High 7.8

CVE-2024-31583

Pytorch use-after-free vulnerability

Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.

pytorch pytorch pytorch torch Debian Ubuntu Azure Linux PyPI

Apr 17, 2024
Medium 4.0

CVE-2024-31580

PyTorch heap buffer overflow vulnerability

PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

pytorch pytorch pytorch torch Debian Ubuntu Azure Linux PyPI

Apr 17, 2024

Revision history

2024-08-12 #2
Neue Updates von Splunk-SVD aufgenommen
2024-04-17 #1
Initiale Fassung

References

NIST Vulnerability Database vom 2024-04-17
https://nvd.nist.gov/vuln/detail/CVE-2024-31580
NIST Vulnerability Database vom 2024-04-17
https://nvd.nist.gov/vuln/detail/CVE-2024-31583
Splunk Security Advisory SVD-2024-0801 vom 2024-08-12
https://advisory.splunk.com//advisories/SVD-2024-0801