PT-2025-19794 · Pytorch+1 · Pytorch+1

Default436352 · Published 2025-05-05 · Updated 2025-05-06 · CVE-2025-4287

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PyTorch version 2.6.0+cu124

Description A vulnerability was found in PyTorch, affecting the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. This issue leads to denial of service and can be exploited on the local host. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply a patch identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. As a temporary workaround, consider disabling the torch.cuda.nccl.reduce function until a patch is available. Restrict access to the torch/cuda/nccl.py file to minimize the risk of exploitation. Avoid using the torch.cuda.nccl.reduce function in the affected API endpoint until the issue is resolved.

Exploit

Fix

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2025-4287

Affected Products

Debian

Pytorch

References · 18

• 🔥 https://github.com/pytorch/pytorch/issues/150836#issue-2979097872 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-4287 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-4287 · Security Note
• https://github.com/Divigroup-RAP/PYTORCH/commit/5827d2061dcb4acd05ac5f8e65d8693a481ba0f5 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-4287 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4287 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-4287 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4287 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-4287 · Vendor Advisory
• https://github.com/pytorch/pytorch/pull/150923 · Note
• https://github.com/pytorch/pytorch/issues/150836 · Note
• https://twitter.com/VulmonFeeds/status/1919502367826862104 · Twitter Post
• https://t.me/cvetracker/23085 · Telegram Post
• https://vuldb.com/?submit.553644 · Note
• https://twitter.com/CVEnew/status/1919491177545433385 · Twitter Post