CVE-2025-63396

Executive Summary

CVE-2025-63396 is a Denial of Service (DoS) vulnerability in PyTorch, affecting versions v2.5 and v2.7.1. The issue arises from the omission of profiler.stop() when using torch.profiler.profile (PythonTracer). During finalization, the profiler can crash or hang, leading to a DoS condition. This vulnerability is local in nature, requiring no user interaction, and has a CVSS score of 0.0 (though this is likely a placeholder). The EPSS score is 0.0%, indicating low exploitation probability at this time. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability affects the PyTorch Python package, which is widely used in machine learning and deep learning workflows. The issue is in the core profiling module, which can be triggered by any user or automated process that uses the profiler without proper cleanup. This could impact CI/CD pipelines, training scripts, or inference servers that rely on profiling. The lack of a patch or advisory from PyTorch increases the risk for unpatched deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder; actual severity is likely higher)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: Medium (due to DoS potential and lack of patch)

Deep Dive & Mechanics

The vulnerability is in the torch.profiler.profile context manager, specifically in the PythonTracer component. When the profiler is used without explicitly calling profiler.stop(), the cleanup during finalization can cause a crash or hang. This is due to improper handling of internal state or resource deallocation.

The profiler is typically used as a context manager:

with torch.profiler.profile() as prof:
    # code to profile
    pass

If the with block is not used (e.g., manual start/stop), or if an exception occurs before stop(), the profiler may not clean up correctly. During garbage collection or interpreter shutdown, this can lead to a deadlock or segmentation fault.

The issue is similar to CWE-404 (Improper Resource Shutdown or Release), where resources are not released properly, leading to a DoS.

Vulnerable vs. Patched Code

Vulnerable Code (PyTorch v2.5, v2.7.1):

import torch

prof = torch.profiler.profile()
prof.start()
# ... profiling code ...
# prof.stop() is never called
# During finalization, crash or hang occurs

Patched Code (Hypothetical):

import torch

prof = torch.profiler.profile()
prof.start()
try:
    # ... profiling code ...
finally:
    prof.stop()  # Ensure cleanup

The fix would involve ensuring that stop() is called in all exit paths, including during exception handling and garbage collection.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to craft a script that uses the profiler without calling stop(). This could be done by:

1. Creating a malicious Python script that imports PyTorch and starts profiling.
2. Triggering an exception or simply not calling stop().
3. Running the script on a target system, causing the profiler to hang or crash during finalization.

Lab Setup:

• Install PyTorch v2.5 or v2.7.1 in a controlled environment.
• Run the following script:

import torch
import time

prof = torch.profiler.profile()
prof.start()
time.sleep(1)
# No prof.stop() called
# Script ends, triggering the vulnerability

• Observe the crash or hang during interpreter shutdown.

Blue Team

To detect exploitation attempts:

1. Monitor for abnormal Python process terminations or hangs.
2. Look for scripts that use torch.profiler.profile without a corresponding stop() call.
3. Use static analysis to detect missing stop() calls in codebases.

Detection Script:

import ast
import sys

def check_profiler_stop(file_path):
    with open(file_path, 'r') as f:
        tree = ast.parse(f.read())
    for node in ast.walk(tree):
        if isinstance(node, ast.Call) and hasattr(node.func, 'attr') and node.func.attr == 'profile':
            # Check if stop() is called in the same scope
            # This is a simplified check
            print(f"Potential vulnerability in {file_path}")

Indicators of Compromise (IOCs)

• Process: Python process using torch.profiler.profile without stop().
• Logs: Error logs indicating a crash in torch.profiler or PythonTracer.
• Network: No network indicators (local DoS).
• File: Scripts containing prof.start() without prof.stop().

Detection Engineering

YARA Rule

rule PyTorch_Profiler_DoS {
    meta:
        description = "Detects missing profiler.stop() in PyTorch scripts"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-63396"
    strings:
        $profiler_start = "prof.start()"
        $profiler_stop = "prof.stop()"
    condition:
        $profiler_start and not $profiler_stop
}

Sigma Rule

title: PyTorch Profiler DoS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects missing profiler.stop() in PyTorch scripts
author: Valters IT
date: 2025/04/10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'torch.profiler.profile'
    condition: selection
falsepositives:
    - Legitimate profiling with proper cleanup
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-63396 PyTorch Profiler DoS"; flow:to_server; content:"torch.profiler.profile"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Ensure all uses of torch.profiler.profile include a call to stop() in a finally block or use the context manager (with statement).
2. Code Review: Scan codebases for missing stop() calls.
3. Patch: Monitor PyTorch releases for a fix. Apply when available.
4. Workaround: Avoid using the profiler in production or critical scripts until a patch is released.
5. Monitoring: Implement detection rules to identify potential exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence