Main Vulnerability Database Vulnerabilities #VU95801

Out-of-bounds read in PyTorch - CVE-2024-31584

Published: August 13, 2024

Vulnerability identifier: #VU95801

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-31584

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in torch/csrc/jit/mobile/flatbuffer_loader.cpp. A local user can trigger an out-of-bounds read error and read contents of memory on the system.

Affected software

PyTorch
IBM Maximo Application Suite

How to mitigate CVE-2024-31584

Install updates from vendor's website.

PyTorch - update to 2.2.0
IBM Maximo Application Suite - addressed in versions 8.10.10, 8.11.7

External References

https://github.com/pytorch/pytorch/commit/7c35874ad664e74c8e4252d67521f3986eadb0e6
https://github.com/pytorch/pytorch/blob/v2.1.2/torch/csrc/jit/mobile/flatbuffer_loader.cpp#L305

Related Security Bulletins