[GH-ISSUE #1307] Vulnerability: Unauthenticated PyTorch TCP endpoint #853

New issue

Open

opened 2026-10-26 21:31:10 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-26 21:31:10 +00:00

Owner

Originally created by @Alb4don on GitHub (May 14, 2026).
Original GitHub issue: https://github.com/deepseek-ai/DeepSeek-V3/issues/1307

The multi-node inference entry point in the DeepSeek V3 model opens an unauthenticated PyTorch TCP endpoint.
The broadcast mechanism serializes objects with pickle. An attacker who reaches this port before all legitimate worker nodes connect can register as a fake rank and inject arbitrary pickle payloads, gaining remote code execution on all GPU worker nodes.

The generates.py reads WORLD_SIZE, RANK, and LOCAL_RANK from environment variables and calls dist.init_process_group("nccl"), the default rendezvous store is tcp://$MASTER_ADDR:29500, opened by torch run.

If world_size > 1:

dist.init_process_group("nccl") ~~> opens the rendezvous at $MASTER_ADDR:29500

If rank == 0:

prompt = input(">>> ")

objects = [prompt]

dist.broadcast_object_list(objects, 0) ~~> serializes the list with pickle
else:

objects = [None]

dist.broadcast_object_list(objects, 0) ~~> the workers deserialize here.

Once the process group is initialized, the rank 0 process collects user input and broadcasts it to all rank processes using dist.broadcast_object_list().
The PyTorch implementation serializes the Python list via pickle whenever the payload is not a raw tensor, which covers all prompt strings.

Originally created by @Alb4don on GitHub (May 14, 2026). Original GitHub issue: https://github.com/deepseek-ai/DeepSeek-V3/issues/1307 - The multi-node inference entry point in the DeepSeek V3 model opens an unauthenticated PyTorch TCP endpoint. - The broadcast mechanism serializes objects with pickle. An attacker who reaches this port before all legitimate worker nodes connect can register as a fake rank and inject arbitrary pickle payloads, gaining remote code execution on all GPU worker nodes. The generates.py reads ***WORLD_SIZE, RANK, and LOCAL_RANK*** from environment variables and calls dist.init_process_group("nccl"), the default rendezvous store is ***tcp://$MASTER_ADDR:29500***, opened by torch run. If world_size > 1: dist.init_process_group("nccl") ~~> opens the rendezvous at $MASTER_ADDR:29500 If rank == 0: prompt = input(">>> ") objects = [prompt] dist.broadcast_object_list(objects, 0) ~~> serializes the list with pickle else: objects = [None] dist.broadcast_object_list(objects, 0) ~~> the workers deserialize here. - Once the process group is initialized, the rank 0 process collects user input and broadcasts it to all rank processes using ***dist.broadcast_object_list()***. - The PyTorch implementation serializes the Python list via pickle whenever the payload is not a raw tensor, which covers all prompt strings.

bsakaguchi commented

2026-10-26 21:31:10 +00:00

Author

Owner

@github-actions[bot] commented on GitHub (Jun 14, 2026):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this issue is still relevant, please leave a comment to keep it open. Thank you for your contributions!

@github-actions[bot] commented on GitHub (Jun 14, 2026): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this issue is still relevant, please leave a comment to keep it open. Thank you for your contributions!

bsakaguchi commented

2026-10-26 21:31:11 +00:00

Author

Owner

@Alb4don commented on GitHub (Jun 24, 2026):

@Alb4don commented on GitHub (Jun 24, 2026): .

bsakaguchi commented

2026-10-26 21:31:11 +00:00

Author

Owner

@github-actions[bot] commented on GitHub (Aug 3, 2026):

@github-actions[bot] commented on GitHub (Aug 3, 2026): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If you believe this issue is still relevant, please leave a comment to keep it open. Thank you for your contributions!