Microsoft DeepSpeed command injection
Date: 2024-10
Affected: Microsoft DeepSpeed
Attack vector: command-injection
Category: real-world
Severity: High
CVE: CVE-2024-43497
CWE: CWE-77
CVSS: 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Arbitrary command injection in DeepSpeed; the first Patch Tuesday bug affecting DeepSpeed. Attackers execute arbitrary code on the system by crafting inputs to vulnerable functions.


Mitigations:

Architectural layers (MAESTRO):