PT-2024-26376 · Unknown · Torchserve

Namannandan · Published 2024-07-18 · Updated 2024-08-07 · CVE-2024-35199

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TorchServe versions prior to 0.11.0

Description The issue arises from the two gRPC ports 7070 and 7071 not being bound to localhost by default, causing them to be bound to all interfaces when TorchServe is launched. Customers using PyTorch inference Deep Learning Containers through Amazon SageMaker and EKS are not affected.

Recommendations For versions prior to 0.11.0, upgrade to TorchServe release 0.11.0 to address this issue. As a temporary workaround, consider configuring the gRPC ports to bind to localhost until the upgrade can be applied. Restrict access to the gRPC ports 7070 and 7071 to minimize the risk of exploitation.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-1256

CWE-668

Related Identifiers

CVE-2024-35199

GHSA-HHPG-V63P-WP7W

Affected Products

Torchserve

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35199.json · Exploit
• https://github.com/pytorch/serve/pull/3083 · Patch
• https://github.com/pytorch/serve/security/advisories/GHSA-hhpg-v63p-wp7w · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-35199 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35199 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hhpg-v63p-wp7w · Vendor Advisory
• https://github.com/pytorch/serve/releases/tag/v0.11.0 · Note
• https://github.com/pytorch/serve · Note
• https://github.com/pytorch/serve/commit/aab99506a17193de217aacc1119d9381dbc6ed2b · Note
• https://t.me/cvedetector/1185 · Telegram Post
• https://t.me/cvenotify/86693 · Telegram Post