NVIDIA Megatron-LM Remote Code Execution Vulnerability via Hybrid Conversion Script

A remote code execution vulnerability has been identified in NVIDIA Megatron-LM, specifically within the hybrid conversion script. This vulnerability allows an attacker to execute arbitrary code by convincing a user to load a maliciously crafted file. Exploitation of this issue could also lead to unauthorized privilege escalation, disclosure of sensitive information, and tampering with data.

Impact

Exploitation of this vulnerability could result in arbitrary code execution, unauthorized privilege escalation, disclosure of sensitive information, and unauthorized data modification.

Remediation

Users are advised to update NVIDIA Megatron-LM to version 0.15.3 or later. The updated version is available on the NVIDIA Megatron-LM GitHub repository.