CVE-2025-3136

Executive Summary

CVE-2025-3136 is a locally exploitable memory corruption vulnerability in PyTorch 2.6.0, specifically within the CUDA caching allocator delete function (torch.cuda.memory.caching_allocator_delete). The flaw resides in c10/cuda/CUDACachingAllocator.cpp and can lead to memory corruption when triggered by a local attacker. The vulnerability has a CVSS score of 0.0 (placeholder) but is classified as problematic due to its local attack vector and potential for denial of service or data integrity compromise. No patch is currently available, and the exploit has been publicly disclosed.

Supply Chain & Package Security

PyTorch is a widely used machine learning framework distributed via PyPI (torch package). This vulnerability affects the core CUDA memory management component, which is critical for GPU-accelerated workloads. Users of PyTorch 2.6.0 on systems with CUDA-enabled GPUs are at risk. The exploit requires local access, making it a concern for shared environments (e.g., cloud GPU instances, multi-tenant ML platforms). Supply chain risk is elevated due to the lack of a patch and the public availability of exploit details.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – The attacker needs low-level privileges (e.g., user account).
• User Interaction (UI): None (N) – No user action needed beyond running the exploit.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Memory corruption can cause crashes or denial of service.

Threat Level: Medium (local exploitation, high availability impact, no patch available).

Deep Dive & Mechanics

The vulnerability is in the torch.cuda.memory.caching_allocator_delete function, which is part of PyTorch's CUDA memory management. The caching allocator reuses GPU memory blocks to reduce allocation overhead. The delete operation is responsible for freeing a previously allocated block. Due to improper handling of memory metadata (e.g., size, pointers, or state flags), a local attacker can trigger a memory corruption by crafting a sequence of allocation and deallocation calls that cause the allocator to operate on a corrupted or dangling pointer.

The root cause likely involves a use-after-free or double-free scenario where the allocator's internal data structures (e.g., free list, block metadata) become inconsistent. This can lead to writing to freed memory or reading from invalid addresses, resulting in crashes or potential code execution (though the description only mentions memory corruption).

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code pattern with a hypothetical fix.

Vulnerable Code (CUDACachingAllocator.cpp, PyTorch 2.6.0):

void caching_allocator_delete(void* ptr) {
    Block* block = reinterpret_cast<Block*>(ptr);
    // No validation of block state or pointer
    if (block->state == ALLOCATED) {
        block->state = FREE;
        // Insert into free list without checking for duplicates
        free_list.push_back(block);
    }
}

Patched Code (Hypothetical):

void caching_allocator_delete(void* ptr) {
    if (!ptr || !is_valid_block(ptr)) {
        return; // Validate pointer
    }
    Block* block = reinterpret_cast<Block*>(ptr);
    if (block->state != ALLOCATED) {
        return; // Prevent double-free
    }
    block->state = FREE;
    // Check for duplicate in free list
    if (std::find(free_list.begin(), free_list.end(), block) == free_list.end()) {
        free_list.push_back(block);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system running PyTorch 2.6.0 with CUDA.
• Low-privilege user account.

Exploit Steps:

1. Identify a PyTorch process using CUDA memory.
2. Use a crafted Python script to repeatedly allocate and deallocate tensors, triggering the vulnerable caching_allocator_delete path.
3. Monitor for crashes or memory corruption.

Example Exploit Script (Python):

import torch
import ctypes

# Load the vulnerable function
libcuda = ctypes.CDLL("libc10_cuda.so")
delete_func = libcuda.torch_cuda_memory_caching_allocator_delete
delete_func.argtypes = [ctypes.c_void_p]
delete_func.restype = None

# Allocate a tensor to get a pointer
tensor = torch.zeros(1024, device='cuda')
ptr = tensor.data_ptr()

# Trigger double-free by calling delete twice
delete_func(ptr)
delete_func(ptr)  # This may cause memory corruption

Blue Team

Detection:

• Monitor for abnormal CUDA memory allocation patterns (e.g., rapid allocate/deallocate cycles).
• Use eBPF to trace calls to caching_allocator_delete and detect double-free attempts.
• Enable PyTorch debug logging to capture allocator errors.

Mitigation:

• Restrict local access to systems running PyTorch.
• Use containerization (e.g., Docker) to isolate PyTorch processes.
• Apply memory protection mechanisms (e.g., ASLR, NX).

Indicators of Compromise (IOCs)

• File: c10/cuda/CUDACachingAllocator.cpp (vulnerable component)
• Process: Python processes using PyTorch with CUDA
• Logs: CUDA errors like "invalid argument" or "out of memory" in system logs
• Network: No network indicators (local exploit)
• Behavior: Repeated calls to torch.cuda.memory_caching_allocator_delete with the same pointer

Detection Engineering

YARA Rule

rule CVE_2025_3136_PyTorch_Memory_Corruption {
    meta:
        description = "Detects PyTorch CUDA caching allocator delete vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-3136"
    strings:
        $s1 = "caching_allocator_delete" ascii wide nocase
        $s2 = "CUDACachingAllocator.cpp" ascii wide nocase
        $s3 = "torch.cuda.memory" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3)
}

Sigma Rule

title: PyTorch CUDA Caching Allocator Delete Exploitation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects repeated calls to torch.cuda.memory_caching_allocator_delete indicating exploitation of CVE-2025-3136
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'torch.cuda.memory_caching_allocator_delete'
    condition: selection
falsepositives:
    - Legitimate PyTorch memory management
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-3136 PyTorch CUDA Memory Corruption Exploit"; flow:to_server; content:"torch.cuda.memory_caching_allocator_delete"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict local access to PyTorch systems. Monitor for unusual CUDA memory behavior.
• Short-term: Apply memory protection (e.g., use torch.cuda.empty_cache() cautiously). Consider downgrading to a previous version if stable.
• Long-term: Await an official patch from PyTorch. Once available, update to the patched version immediately.
• Workaround: Disable CUDA memory caching by setting environment variable PYTORCH_NO_CUDA_MEMORY_CACHING=1 (may impact performance).

Valters IT
Securing Digital Frontiers