NVIDIA APEX Deserialization Vulnerability in PyTorch Environments Prior to 2.6 Allowing Code Execution and Privilege Escalation

A vulnerability exists in NVIDIA APEX for Linux, where an unauthorized attacker could exploit deserialization of untrusted data. This issue affects environments using PyTorch versions prior to 2.6. Exploitation of this vulnerability could lead to code execution, denial of service, privilege escalation, data tampering, and information disclosure.

Impact

Successful exploitation could result in unauthorized code execution, denial of service, elevated privileges, unauthorized data modification, and exposure of sensitive information.

Remediation

To address this vulnerability, update NVIDIA APEX to include commit db8e053 or later. Ensure that your environment uses PyTorch 2.6 or later.