CVE-2025-46149

Executive Summary

CVE-2025-46149 is a denial-of-service vulnerability in PyTorch, specifically within the nn.Fold module when the Inductor JIT compiler is enabled. The vulnerability manifests as an assertion error, which can be triggered by a crafted input tensor, leading to a crash of the application. This is a low-severity issue (CVSS 0.0) with no known public exploit or active weaponization (EPSS 0.0%). The primary risk is service disruption in production environments that rely on PyTorch for inference or training with Inductor enabled.

Supply Chain & Package Security

PyTorch is a widely used open-source machine learning framework distributed via PyPI, Conda, and source. The vulnerability exists in the core library and is not a dependency injection or malicious package issue. However, organizations should verify the integrity of their PyTorch installation (e.g., via checksums or signed packages) and ensure they are not using compromised mirrors.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (None)
• Vector: UNKNOWN (No official vector assigned)
• Attack Vector (AV): Local (requires ability to provide input to a PyTorch model)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): Low (causes assertion failure/crash)

Threat Level: Low. The vulnerability is a denial-of-service condition with no data breach or code execution risk. It is not actively exploited in the wild.

Deep Dive & Mechanics

The nn.Fold module in PyTorch is used to combine sliding local blocks into a large containing tensor. It is the inverse operation of nn.Unfold. The vulnerability occurs when the Inductor JIT compiler is used to optimize the model.

Root Cause: An assertion within the Inductor-optimized implementation of nn.Fold fails when provided with specific input shapes or parameters. The assertion is intended to validate internal tensor dimensions, but it does not account for all valid input configurations, leading to a false positive and a crash.

Trigger Condition: The vulnerability is triggered by passing a tensor with specific dimensions to nn.Fold when the model is compiled with torch.compile using the Inductor backend. The exact input shape that triggers the assertion is not publicly documented, but it involves edge cases in the folding operation (e.g., non-divisible dimensions, extreme padding, or stride values).

Impact: The application crashes with an AssertionError. This can be used by an attacker to cause a denial of service if they can control the input to a PyTorch model (e.g., via an API endpoint).

Vulnerable vs. Patched Code

Vulnerable Code (PyTorch < 2.7.0): The vulnerable code is in the Inductor-generated kernel for nn.Fold. The exact location is in the C++/CUDA code generated by the Inductor compiler. The assertion is likely in a shape-checking function.

// Hypothetical vulnerable assertion in Inductor-generated code
TORCH_CHECK(output_size == expected_size, "Assertion failed: output size mismatch");

Patched Code (PyTorch 2.7.0): The patch modifies the assertion logic to handle edge cases correctly, or removes the assertion entirely and handles the condition gracefully.

// Patched code - handles edge case without assertion
if (output_size != expected_size) {
    // Handle gracefully, e.g., resize or return error
    output = output.resize_({expected_size});
}

Exploitation & Lab Setup

Red Team (Proof of Concept)

Since no public exploit exists, a proof of concept can be developed by fuzzing the nn.Fold module with various input shapes.

Lab Setup:

1. Install PyTorch 2.6.x (vulnerable version).
2. Create a simple model using nn.Fold.
3. Compile the model with torch.compile(backend='inductor').
4. Iterate over different input tensor shapes to find the crash condition.

import torch
import torch.nn as nn

# Vulnerable PyTorch version
print(torch.__version__)

class FoldModel(nn.Module):
    def __init__(self):
        super().__init__()
        self.fold = nn.Fold(output_size=(4, 5), kernel_size=(2, 2))

    def forward(self, x):
        return self.fold(x)

model = FoldModel()
compiled_model = torch.compile(model, backend='inductor')

# Fuzzing loop - try different input shapes
for h in range(1, 10):
    for w in range(1, 10):
        try:
            # Input shape: (N, C * kernel_h * kernel_w, L)
            input_tensor = torch.randn(1, 4 * 2 * 2, h * w)
            output = compiled_model(input_tensor)
            print(f"Success: h={h}, w={w}")
        except AssertionError as e:
            print(f"Crash: h={h}, w={w} - {e}")
            # This is the trigger

Blue Team (Detection & Hardening)

Detection:

• Monitor application logs for AssertionError originating from PyTorch.
• Set up alerts for sudden crashes of PyTorch-based services.
• Use runtime application self-protection (RASP) to catch assertion failures.

Hardening:

• Upgrade to PyTorch 2.7.0 or later.
• If immediate upgrade is not possible, disable Inductor for models using nn.Fold:

  model = torch.compile(model, backend='eager')  # Fallback to eager mode
  

• Implement input validation to reject tensors with suspicious dimensions.
• Run PyTorch in a sandboxed environment (e.g., container with resource limits) to mitigate DoS impact.

Indicators of Compromise (IOCs)

• Log Entry: AssertionError: ... in PyTorch logs.
• Crash Dump: Core dump or stack trace showing nn.Fold and Inductor code.
• Network: No network-based IOCs (local vulnerability).
• File: No specific file artifacts.

Detection Engineering

YARA Rule

rule CVE_2025_46149_PyTorch_Fold_Assertion
{
    meta:
        description = "Detects PyTorch nn.Fold assertion error in logs or crash dumps"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-46149"
    strings:
        $assert = "AssertionError" nocase
        $fold = "nn.Fold" nocase
        $inductor = "inductor" nocase
    condition:
        all of them
}

Sigma Rule

title: PyTorch nn.Fold Assertion Error
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects PyTorch nn.Fold assertion errors indicating CVE-2025-46149 exploitation attempt
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: pytorch
detection:
    selection:
        EventID: 1000  # Application Error (Windows)
        Message|contains|all:
            - 'AssertionError'
            - 'nn.Fold'
            - 'inductor'
    condition: selection
falsepositives:
    - Legitimate use of nn.Fold with edge-case inputs (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-46149 PyTorch nn.Fold DoS Attempt"; flow:to_server; content:"nn.Fold"; http_uri; content:"inductor"; http_uri; classtype:attempted-dos; sid:1000001; rev:1;)

Note: Since this is a local vulnerability, network-based detection is limited. The Suricata rule above is a placeholder for hypothetical API endpoints that pass model parameters.

Remediation & Mitigation

Immediate:

• Upgrade PyTorch to version 2.7.0 or later.
• If upgrade is not possible, disable Inductor for models using nn.Fold:

  torch.compile(model, backend='eager')
  

Long-term:

• Implement input validation for all model inputs.
• Use runtime monitoring to detect assertion failures.
• Keep PyTorch and all dependencies up to date.
• Consider using a Web Application Firewall (WAF) if the model is exposed via an API.

Workaround:

• Replace nn.Fold with a custom implementation that handles edge cases gracefully.

Valters IT
DevSecOps & Cyber Threat Intelligence