NVIDIA Megatron-LM Code Injection Vulnerability in Pretraining Script Allowing Code Execution and Privilege Escalation

A code injection vulnerability has been identified in the NVIDIA Megatron-LM pretrain_gpt script, all platforms. This issue allows an attacker to inject malicious data that could be executed as code. Exploitation of this vulnerability could result in unauthorized code execution, elevated privileges, disclosure of sensitive information, and tampering with data.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution, escalation of privileges, disclosure of sensitive information, and unauthorized data modification.

Remediation

Users are advised to update to version 0.13.1 or 0.12.3 and later. This update is available on the NVIDIA Megatron-LM GitHub repository.