repository icon
microsoft / deepspeed Project repository

DeepSpeed is a deep learning optimization library that makes distributed training and inference easy, efficient, and effective.

Submit a report

FIRST INTERACTION

WITHIN28 DAYS

REVIEW

WITHIN42 DAYS

FIX

WITHIN86 DAYS

Denial of Service (DoS) via Unrestricted Memory Allocation in Gather Operation
hope4real
informative
High
TOCTOU Vulnerability and Infinite Loop in regular_read File Read Function
hope4real
informative
High
OS Command Injection in subprocess.Popen()
hope4real
duplicate
Critical
Arbitrary File Read via Unsanitized File Path in get_header_c(fp)
hope4real
informative
High
Unsafe Environment Variable Handling Leading to Potential Security & Performanc...
tugar2003
informative
Medium
Bug Bounty Report: Command Injection Vulnerability in subprocess Call
tugar2003
Medium
•$125
Delete any file in the system at main_parallel_write and main_handle_write
hainguyen0207
duplicate
High
High-Severity Command Injection Vulnerability in run_BingBertSquad.sh
willjtools
Medium
•$125
Delete any file in the system at main_parallel_write and main_handle_write
hainguyen0207
pending
Delete any folder in the system with remove_folder
hainguyen0207
Medium
•$125
Read any file on the system at fetch_hostfile
hainguyen0207
Low
•$20
Arbitrary Python Code Execution via OpBuilder.command_exists() Python API
zpbrent
Medium
•$125
Command Injection Vulnerability in is_nfs_path Function of DeepSpeed's matmul_ex...
bayuncao
informative
Critical
Remote Code Execution via Pickle Deserialization in p2p.recv_obj()
zpbrent
High
•$750
Stored Command Injection in launch.py
chaitu577
informative
High
Command Injection Vulnerability in check_for_libaio_pkg Function
cyfra07
High
•$750•CVE-2024-43497
Insecure Temporary File in DeepSpeed
startr4ck
informative
Medium
CSV Injection CSV Monitoring feature
rook1337
self closed
Deserialization of Untrusted Data
kienzx203
High
•$750
self closed
duongli99
self closed
Os Command injection
kienzx203
Medium
•$125