CVE-2025-4287: 
Linux Debian vulnerability analysis and mitigation

A vulnerability was identified in PyTorch version 2.6.0+cu124, specifically affecting the function torch.cuda.nccl.reduce in the file torch/cuda/nccl.py. The vulnerability was discovered and disclosed in April 2025, and has been assigned CVE-2025-4287. The issue has been rated as problematic and can lead to denial of service when exploited (Wiz, NVD).

The vulnerability stems from improper validation of operation codes in the NCCL (NVIDIA Collective Communications Library) reduce function. When invalid operation codes are provided to the torch.cuda.nccl.reduce function, the program crashes with an 'Aborted (core dumped)' error instead of properly validating the input or raising a RuntimeError. The vulnerability has been assigned a CVSS v4.0 score of 4.8 (MEDIUM) with vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (NVD, VulDB).

The vulnerability leads to denial of service when exploited, affecting the local system running PyTorch. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (NVD, VulDB).

A patch has been identified with commit ID 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5, which adds proper operation code validation for NCCL operations. The fix includes additional checks for operation types and related test cases to prevent similar issues (GitHub Commit).