PT-2022-7517 · Pytorch+1 · Pytorch+1

Lyutoo · Published 2022-11-11 · Updated 2024-03-06 · CVE-2022-45907

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PyTorch versions prior to 1.13.1

Description The issue is related to the incorrect management of code generation in the torch.jit.annotations.parse type line() function of the PyTorch machine learning framework. This can allow a remote attacker to execute arbitrary code because eval is used unsafely.

Recommendations For versions prior to 1.13.1, update to version 1.13.1 to resolve the issue. As a temporary workaround, consider restricting the use of the torch.jit.annotations.parse type line() function until a patch is available.

Exploit

Fix

Command Injection

Code Injection

Weakness Enumeration

CWE-77

CWE-94

Related Identifiers

BDU:2024-06840

BIT-PYTORCH-2022-45907

CVE-2022-45907

GHSA-47FC-VMWQ-366V

PYSEC-2022-43015

Affected Products

Debian

Pytorch

References · 21

• 🔥 https://github.com/pytorch/pytorch/issues/88868 · Exploit
• https://github.com/pytorch/pytorch/commit/767f6aa49fe20a2766b9843d01e3b7f7793df6a3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-45907 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-45907 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45907 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45907 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-45907 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43015 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-47fc-vmwq-366v · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-45907 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-45907 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-pytorch-2022-45907 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06840 · Security Note
• https://github.com/pytorch/pytorch · Note
• https://github.com/pytorch/pytorch/pull/89189 · Note