NVIDIA Megatron-LM für alle Plattformen enthält eine Schwachstelle im msdp Vorverarbeitungs-Skript, bei der bösartige Daten, die von einem Angreifer erstellt wurden, eine Injektion verursachen können. Ein erfolgreicher Exploit dieser Schwachstelle

The vulnerability lies within the msdp preprocessing script, where insufficient input validation allows attackers to inject malicious data. Successful exploitation could result in arbitrary code execution on the affected system, granting the attacker complete control. This could lead to privilege escalation, allowing the attacker to gain higher-level access. Furthermore, the vulnerability poses a significant risk of data disclosure, as sensitive information processed by Megatron-LM could be exposed. Data tampering is also a possibility, enabling attackers to modify training data or model outputs, potentially compromising the integrity of the entire system. The impact is particularly severe in environments where Megatron-LM is used for critical applications or processes.

Organizations and researchers utilizing NVIDIA Megatron-LM for large language model training, particularly those relying on the msdp preprocessing script for data preparation, are at risk. This includes those deploying Megatron-LM in cloud environments or on systems with limited security controls.

• python / supply-chain:

import os
import subprocess

# Check for vulnerable Megatron-LM versions
process = subprocess.Popen(['python', '-c', 'import megatron_lm; print(megatron_lm.__version__)'], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
stdout, stderr = process.communicate()
version = stdout.decode('utf-8').strip()

if version and (float(version) < 0.13.1 or float(version) < 0.12.3):
    print(f"Vulnerable Megatron-LM version detected: {version}")

• generic web: Check for unusual activity or unexpected data patterns in the msdp preprocessing script logs.

1. 2025-09-24Disclosure

   disclosure

1. Reserviert2025-01-14
2. Veröffentlicht2025-09-24
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-23353 is to upgrade to NVIDIA Megatron-LM version 0.13.1 or later. This version includes the necessary fixes to prevent malicious data injection. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider implementing stricter input validation on the msdp preprocessing script to sanitize user-provided data. While not a complete solution, this can reduce the attack surface. Monitoring the msdp script for unusual activity or unexpected data patterns can also help detect potential exploitation attempts. After upgrading, verify the fix by attempting to inject malicious data into the msdp script and confirming that it is properly sanitized.