To mitigate these vulnerabilities, users are advised to upgrade to TorchServe 0.8.2 and correctly configure the management console. Additionally, servers should only fetch models from trusted domains. Amazon has published a security bulletin providing further guidance, and Oligo has released a free checker tool for admins to check if their instances are vulnerable to ShellTorch attacks.
Key takeaways:
- A set of vulnerabilities named 'ShellTorch' has been discovered in the open-source TorchServe AI model-serving tool, affecting tens of thousands of internet-exposed servers, including those of large organizations.
- The vulnerabilities can lead to unauthorized server access and remote code execution on vulnerable instances, and if chained together, could easily compromise a system running vulnerable versions of TorchServe.
- To mitigate these vulnerabilities, users are advised to upgrade to TorchServe 0.8.2, correctly configure the management console, and ensure that their server fetches models only from trusted domains.
- Oligo has released a free checker tool that admins can use to check if their instances are vulnerable to ShellTorch attacks.