CVE-2025-46152

Executive Summary

CVE-2025-46152 is a computational correctness vulnerability in PyTorch, an open-source machine learning framework. The flaw resides in the bitwise_right_shift operation, which produces incorrect output when the other argument (the shift amount) is an out-of-bounds value. This can lead to silent data corruption, potentially affecting model training, inference, or any numerical computation relying on bitwise shifts. While the CVSS score is 0.0 (likely unassigned or placeholder), the impact is on data integrity and reliability, not direct remote code execution. The vulnerability is patched in PyTorch version 2.7.0.

Supply Chain & Package Security

PyTorch is distributed via PyPI (torch), Conda, and source builds. This vulnerability affects all users of PyTorch versions prior to 2.7.0. Organizations using PyTorch in production, CI/CD pipelines, or containerized environments should verify their dependency versions. The package is widely used in AI/ML pipelines, making supply chain integrity critical.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned / Placeholder)
• Attack Vector (AV): N/A
• Attack Complexity (AC): N/A
• Privileges Required (PR): N/A
• User Interaction (UI): N/A
• Scope (S): N/A
• Confidentiality (C): N/A
• Integrity (I): N/A
• Availability (A): N/A

Threat Level: Low (Data Integrity). The vulnerability does not enable remote code execution or privilege escalation. However, it can cause silent data corruption in numerical computations, which may have downstream impacts on model accuracy or system behavior.

Deep Dive & Mechanics

The bitwise_right_shift operation in PyTorch is implemented in C++ (likely using ATen or CUDA kernels). The vulnerability occurs when the other argument (shift amount) is outside the valid range for the data type of the input tensor. For example, shifting a 32-bit integer by 32 or more bits, or by a negative amount, should produce a defined result (e.g., 0 for unsigned types, sign extension for signed types). Instead, the operation produces incorrect or undefined values.

Root Cause: Insufficient bounds checking or incorrect handling of out-of-range shift amounts in the underlying implementation. This is a classic CWE-682 (Incorrect Calculation) issue.

Impact: Silent data corruption. A model training on corrupted data may converge to incorrect weights, or inference may produce wrong predictions. This is particularly dangerous in safety-critical applications (e.g., autonomous driving, medical diagnosis).

Vulnerable vs. Patched Code

Vulnerable (pre-2.7.0):

import torch
x = torch.tensor([1, 2, 4, 8], dtype=torch.int32)
y = torch.tensor([32, 33, -1, 0], dtype=torch.int32)
result = torch.bitwise_right_shift(x, y)
# Incorrect: may produce unexpected values for shift amounts 32, 33, -1

Patched (2.7.0+):

import torch
x = torch.tensor([1, 2, 4, 8], dtype=torch.int32)
y = torch.tensor([32, 33, -1, 0], dtype=torch.int32)
result = torch.bitwise_right_shift(x, y)
# Correct: shift amounts are clamped or handled properly (e.g., 32 -> 0 for unsigned)

The patch likely adds clamping logic or explicit handling of out-of-bounds shift amounts, ensuring the output is deterministic and correct.

Exploitation & Lab Setup

Red Team

Objective: Exploit the vulnerability to cause silent data corruption in a target ML pipeline.

Lab Setup:

1. Install PyTorch < 2.7.0: pip install torch==2.6.0
2. Create a script that uses bitwise_right_shift with malicious shift amounts.
3. Inject the corrupted tensor into a model's training loop.

Example Exploit Script:

import torch
import torch.nn as nn

# Victim model
model = nn.Linear(10, 1)
optimizer = torch.optim.SGD(model.parameters(), lr=0.01)

# Corrupted input
x = torch.randint(0, 256, (100, 10), dtype=torch.int32)
shift = torch.full((100, 10), 32, dtype=torch.int32)  # Out-of-bounds
corrupted_x = torch.bitwise_right_shift(x, shift)

# Training loop (corrupted data)
for epoch in range(10):
    output = model(corrupted_x.float())
    loss = output.sum()
    loss.backward()
    optimizer.step()

Expected Outcome: The model trains on corrupted data, leading to incorrect weights and potentially wrong predictions.

Blue Team

Detection:

1. Monitor for usage of bitwise_right_shift with suspicious shift amounts (e.g., >= bit width of input type).
2. Check PyTorch version in use.
3. Validate model outputs for unexpected patterns.

Mitigation:

1. Upgrade to PyTorch 2.7.0+.
2. Implement input validation for shift amounts in custom code.
3. Use static analysis to detect out-of-bounds shift operations.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): N/A (No known malicious files)
• Network Indicators: N/A (No network exploitation)
• Behavioral: Unexpected model behavior, training divergence, or incorrect inference results.
• Log Artifacts: Logs showing bitwise_right_shift operations with shift amounts >= 32 (for int32) or >= 64 (for int64).

Detection Engineering

YARA Rule

rule CVE_2025_46152_PyTorch_BitwiseShift
{
    meta:
        description = "Detects PyTorch versions vulnerable to CVE-2025-46152"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-46152"
    strings:
        $torch_version = /torch==[0-1]\.\d+\.\d+|torch==2\.[0-6]\.\d+/ nocase
    condition:
        $torch_version
}

Sigma Rule

title: CVE-2025-46152 - PyTorch Bitwise Right Shift Vulnerability
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects usage of PyTorch bitwise_right_shift with out-of-bounds shift amounts
author: Valters IT
date: 2025-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains: 'bitwise_right_shift'
    condition: selection
falsepositives:
    - Legitimate use with valid shift amounts
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-46152 - PyTorch Bitwise Shift Exploit Attempt"; flow:to_server,established; content:"bitwise_right_shift"; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade PyTorch to version 2.7.0 or later.
2. Compensating Controls: Implement input validation for shift amounts in any custom code using bitwise_right_shift. Ensure shift amounts are within the valid range (0 to bit_width-1).
3. Monitoring: Monitor for anomalous model behavior that may indicate data corruption.
4. Supply Chain: Verify PyTorch version in all environments (development, CI/CD, production).

Patch Command:

pip install --upgrade torch

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert