CVE-2025-2953PyTorch torch.mkldnn_max_pool2d denial of service

Descripción

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The security policy of the project warns to use unknown models which might establish malicious effects.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• VDB-302006 | PyTorch torch.mkldnn_max_pool2d denial of service vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
• VDB-302006 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-requiredPermissions RequiredVDB Entry
• Submit #521279 | pytorch PyTorch version: 2.6.0+cu124 Floating point exception third-party-advisoryThird Party AdvisoryVDB Entry
• https://github.com/pytorch/pytorch/issues/149274 issue-trackingExploitIssue Tracking
• https://github.com/pytorch/pytorch/issues/149274#issue-2923122269 exploitissue-trackingExploitIssue Tracking
• https://github.com/pytorch/pytorch/blob/main/SECURITY.md#untrusted-models related