Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

ciflow/torchtitan/185414: [torchelastic] handle d-state process (#185414)

Summary: The torchrun elastic agent logged ChildFailedError, then went silent — never exited — until a manual kill, at which point twinfra spent ~1min sending stop signals every second that the container ignored. Root cause inside torch ela…

0
↗ Quelle (github.com)
Reagiere als Erste:r — dein Feedback zählt!

Summary:


The torchrun elastic agent logged ChildFailedError, then went silent

— never exited — until a manual kill, at which point twinfra spent ~1min

sending stop signals every second that the container ignored.


Root cause inside torch elastic: when workers wedge on a kernel resource

(NCCL/GPU/RDMA — Linux D-state) SIGKILL cannot reap them, and both

MultiprocessContext._close and SubprocessContext._close end in an unbounded

proc.join() / proc.wait(). The agent itself wedges on that join, so the

supervising launcher can never exit and MAST keeps the slot pinned.


Two changes here:




  1. Bound the final proc.join() (api.py:900) and proc.wait() (api.py:1054)

    with the same timeout the rest of _close already honors. On timeout, log

    the unkillable PID (with the SIGKILL signal name and advice that the host

    may need recycling) and continue. The agent process can now exit even when

    workers are unkillable.




  2. Make the D-state detection added in the prior change actually escalate:

    when _check_d_state_timeout fires, set _remaining_restarts = 0 before

    returning UNHEALTHY. A D-state worker still holds GPU/NIC on the host, so

    a fresh worker group on the same host would conflict; we want _invoke_run

    to take the _stop_workers + return branch and exit immediately.




Caveat: this diff lets the supervisor exit cleanly. It does not free the

wedged worker processes on the host — those still need host recycling for the

GPUs to be reusable, since no userspace signal can unblock a process in true

D-state. The new error log surfaces the offending PIDs so oncall can recycle

the host explicitly.


Authored by Claude.


Test Plan:

New unit tests:




  • BoundedCloseTest in test/distributed/elastic/multiprocessing/api_test.py

    covers both MultiprocessContext._close and SubprocessContext._close.

    Each test mocks an unkillable process whose is_alive/poll always reports

    alive and whose join/wait honor the timeout but never resolve. Asserts

    _close returns in <5s (two bounded joins of 1s each + epsilon) instead of

    hanging forever.




  • Extended LocalElasticAgentDStateTest::test_check_d_state_timeout_fires in

    test/distributed/elastic/agent/server/test/local_elastic_agent_test.py to

    assert _remaining_restarts is set to 0 when the D-state timeout fires.




Reviewed By: d4l3k


Differential Revision: D105652547

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - ciflow/torchtitan/185414: [torchelastic] handle d-state process (#185414)
id: 1508fa63-f532-4c24-a9d8-e956f33a781f
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "ciflow/torchtitan/185414: [tor" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("ciflowtorchtitan185414 torchelastic hand")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*ciflowtorchtitan185414 torchelastic hand*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "ciflowtorchtitan185414 torchelastic hand"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph3 Knoten / 2 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich ciflow/torchtitan/185414: [torchelastic].... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten ciflow/torchtitan/185414: [torchelastic] handle d-state process (#185414)

Thematisch verwandte Begriffe: ciflowtorchtitan185414, torchelastic, handle, dstate · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100503 | Ghidra versions through 12.1.4 contain a heap use-after-free vulnerabil…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag