CVE-2025-4287

EUVD-2025-13418

05.05.2025, 20:15

A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.3 LOW	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 7.36%

Debian Releases

Debian Product

Codename

pytorch

bookworm	no-dsa
bullseye	postponed
bullseye (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

pytorch

focal	dne
jammy	needs-triage
noble	dne
oracular	ignored
plucky	ignored
questing	ignored
resolute	needs-triage

Common Weakness Enumeration

CWE-404 - Improper Resource Shutdown or Release
The program does not release or incorrectly releases a resource before it is made available for re-use.

References

https://github.com/Divigroup-RAP/PYTORCH/commit/5827d2061dcb4acd05ac5f8e65d8693a481ba0f5

https://github.com/pytorch/pytorch/issues/150836

https://github.com/pytorch/pytorch/issues/150836#issue-2979097872

https://github.com/pytorch/pytorch/pull/150923

https://vuldb.com/?ctiid.307394

https://vuldb.com/?id.307394

https://vuldb.com/?submit.553644