AVID-2026-R1529

Description

DeepSpeed Remote Code Execution Vulnerability (CVE-2024-43497)

Details

DeepSpeed Remote Code Execution Vulnerability

Reason for inclusion in AVID: CVE-2024-43497 describes a remote code execution vulnerability in DeepSpeed, a library widely used in AI model training and deployment stacks. This is a software supply chain issue within AI software packages/frameworks, not hardware/firmware. It directly affects components used to build/train/run general-purpose AI systems, and exposes security risk (RCE). Evidence includes CVE ID, description of RCE, and CWE-77 (command injection).

References

Affected or Relevant Artifacts

Developer: Microsoft
Deployer: Microsoft
Artifact Details:

Type	Name
System	DeepSpeed

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Base Score	8.4
Base Severity	🔴 High

CWE

ID	Description
CWE-77	CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-10-08
Version: 0.3.3
AVID Entry