Find, fix and prevent vulnerabilities in your code.

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Buffer Overflow due to the unpack_sequence function. An attacker can corrupt memory by manipulating the function's input. This is only exploitable if the attacker has local access to the system.

Remediation

Upgrade torch to version 2.10.0 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the ctc_loss() function in LossCTC.cpp, when running on a CUDA system. An attacker can cause the application to crash by passing in input with empty tensors.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade torch to version 2.8.0 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Improper Resource Shutdown or Release through the torch.cuda.nccl.reduce function in the file torch/cuda/nccl.py. An attacker can cause the application to crash by manipulating the function inputs on a local host.

Remediation

A fix was pushed into the master branch but not yet published.

References

• GitHub Issue
• GitHub PR

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Race Condition in the torch.jit.annotations.parse_type_line function. This allowes simultaneous reading and writing the set of devices without synchronizing.

Remediation

Upgrade torch to version 1.10.0 or higher.

References

• GitHub Commit
• GitHub PR

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Race Condition in the database management. This occurred due to concurrent access to shared resources without adequate synchronization, causing unpredictable system behavior.

Remediation

Upgrade torch to version 1.13.0 or higher.

References

• GitHub Commit

Overview

scikit-learn is a Python module for machine learning built on top of SciPy and is distributed under the 3-Clause BSD license.

Affected versions of this package are vulnerable to Storage of Sensitive Data in a Mechanism without Access Control due to the unexpected storage of all tokens present in the training data within the stop_words_ attribute. An attacker can access sensitive information, such as passwords or keys, by exploiting this behavior.

PoC

Limiting vocabulary is a very common setting hence provided by the library. The expected behaviour is that the object stores the frequent tokens, and discards the rest after the fitting process. In theory and practice, the vectorizer only needs the vocabulary and the rest of the possible tokens will be simply non needed, hence should be discarded.

While the object correctly forms the required vocabulary, it stores the rest of the tokens in the `stop_words_ attribute. Therefore stores the entire unique tokens that have been passed in the fitting operation. Below it's demonstrated this:

# ╰─$ pip freeze | grep pandas
# pandas==2.2.1
import pandas as pd
# ╰─$ pip freeze | grep scikit-learn
# scikit-learn==1.4.1.post1
from sklearn.feature_extraction.text import TfidfVectorizer

if __name__ == '__main__':
    # Fitting the vectorizer will save every token presented
    vectorizer = TfidfVectorizer(
        max_features=2,
        # min_df=2/6  # Same results occur with different ways of limiting the vocabulary
    ).fit(
        pd.Series([
            "hello", "world", "hello", "world", "secretkey", "password123"
        ])
    )
    # Expected storage for frequent tokens
    print(vectorizer.vocabulary_)  # {'hello': 0, 'server': 1}
    # Unexpected data leak
    print(vectorizer.stop_words_)  # {'password123', 'secretkey'}

It is demonstrated below that the storage in the stop_words_ attribute is unnecessary. Nullifying the attribute will give the same results:

# ╰─$ pip freeze | grep pandas
# pandas==2.2.1
import pandas as pd
# ╰─$ pip freeze | grep scikit-learn
# scikit-learn==1.4.1.post1
from sklearn.feature_extraction.text import TfidfVectorizer

if __name__ == '__main__':
    # Fitting the vectorizer will save every token presented
    vectorizer = TfidfVectorizer(
        max_features=2,
        # min_df=2/6  # Same results occur with different ways of limiting the vocabulary
    ).fit(
        pd.Series([
            "hello", "world", "hello", "world", "secretkey", "password123"
        ])
    )
    # Expected storage for frequent tokens
    print(vectorizer.vocabulary_)  # {'hello': 0, 'server': 1}
    # Unexpected data leak
    print(vectorizer.stop_words_)  # {'password123', 'secretkey'}

    # Wiping-out the stop_words_ attribute does not change the behaviour
    print(vectorizer.transform(["hello world"]).toarray())  # [[0.70710678 0.70710678]]
    vectorizer.stop_words_ = None
    assert vectorizer.stop_words_ is None
    print(vectorizer.transform(["hello world"]).toarray())  # [[0.70710678 0.70710678]]

Remediation

Upgrade scikit-learn to version 1.5.0 or higher.

References

• GitHub Commit

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Improper Handling of Undefined Values in the torch.cummin component when compiling a model with Inductor. An attacker can cause the application to crash or become unresponsive by submitting a specially crafted model that triggers a name resolution error during compilation.

Remediation

Upgrade torch to version 2.8.0 or higher.

References

• GitHub Gist
• GitHub Issue
• GitHub PR

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the torch.Tensor.random_() function when a model is compiled with Inductor. An attacker can cause the application to crash or become unresponsive by triggering a syntax error.

Remediation

Upgrade torch to version 2.8.0 or higher.

References

• GitHub Gist
• GitHub Issue
• GitHub PR

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Improper Resource Shutdown or Release via the torch.mkldnn_max_pool2d function. An attacker can disrupt service by exploiting this vulnerability locally and causing a Floating point exception crash.

PoC

import torch

x = torch.randn(2, 64, 32, 32).to_mkldnn()
out2 = torch.mkldnn_max_pool2d(x, kernel_size=3, stride=0)

Remediation

Upgrade torch to version 2.7.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• Red Hat Bugzilla Bug

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Mismatched Memory Management Routines through the torch.cuda.memory.caching_allocator_delete function. An attacker can corrupt memory by manipulating the function locally.

Remediation

There is no fixed version for torch.

References

• GitHub Issue
• Vulnerable Code
• Vulnerable Code

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Out-of-bounds Write when using @torch.jit.script. An attacker can corrupt memory by manipulating the function's input.

Note: This is only exploitable if the attacker has local access to the system.

Remediation

There is no fixed version for torch.

References

• GitHub Issue

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Out-of-bounds Write due to the torch.lstm_cell function. An attacker can corrupt memory by manipulating the function's input.

Note: This is only exploitable if the attacker has local access to the system.

Remediation

A fix was pushed into the master branch but not yet published.

References

• GitHub Commit
• GitHub Issue
• Vulnerable Code
• Vulnerable Code

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Out-of-bounds Write through the torch.jit.jit_module_from_flatbuffer function. An attacker can corrupt memory by manipulating the input data to this function.

Remediation

There is no fixed version for torch.

References

• GitHub Issue
• Vulnerable Code

Overview

Affected versions of this package are vulnerable to Injection due to the handling of optional non-boolean CLI arguments such as --delim, --buf-size, --manpath through python's eval function. An attacker can execute arbitrary code by injecting malicious input into these arguments.

PoC

python -m tqdm --manpath="\" + str(exec(\"import os\nos.system('echo hi && killall python3')\")) + \""

Remediation

Upgrade tqdm to version 4.66.3 or higher.

References

• GitHub Commit

Overview

torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the torch.nan_to_num() function when used with .long() to convert float("inf") in eager mode. An attacker can cause unexpected behavior by providing specially crafted input that triggers an integer overflow.

Remediation

There is no fixed version for torch.

References

• GitHub Gist
• GitHub Issue
• GitHub PR