Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-4287
CVE-2025-4287:
Linux Debian vulnerability analysis and mitigation
Overview
A vulnerability was identified in PyTorch version 2.6.0+cu124, specifically affecting the function torch.cuda.nccl.reduce in the file torch/cuda/nccl.py. The vulnerability was discovered and disclosed in April 2025, and has been assigned CVE-2025-4287. The issue has been rated as problematic and can lead to denial of service when exploited (NVD, MITRE).
Technical details
The vulnerability stems from improper validation of operation codes in the NCCL (NVIDIA Collective Communications Library) reduce function. When invalid operation codes are provided to the torch.cuda.nccl.reduce function, the program crashes with an 'Aborted (core dumped)' error instead of properly validating the input or raising a RuntimeError. The vulnerability has been assigned a CVSS v4.0 score of 4.8 (MEDIUM) with vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (NVD).
Impact
The vulnerability leads to denial of service when exploited, affecting the local system running PyTorch. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (NVD).
Mitigation and workarounds
A patch has been identified with commit ID 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5, which adds proper operation code validation for NCCL operations. The fix includes additional checks for operation types and related test cases to prevent similar issues (GitHub PR).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management