CVE-2025-46152
📋 TL;DR
A vulnerability in PyTorch's bitwise_right_shift function produces incorrect output when given out-of-bounds values for the 'other' argument. This could lead to incorrect calculations in machine learning models or data processing pipelines. Users of PyTorch versions before 2.7.0 are affected.
💻 Affected Systems
- PyTorch
📦 What is this software?
Pytorch by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Incorrect model outputs leading to wrong decisions in critical systems like autonomous vehicles, medical diagnostics, or financial predictions.
Likely Case
Subtle calculation errors in machine learning pipelines causing degraded model performance or unexpected behavior.
If Mitigated
Limited impact if proper input validation and error handling are implemented in application code.
🎯 Exploit Status
Exploitation requires control over the 'other' argument passed to bitwise_right_shift function calls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PyTorch 2.7.0 and later
Vendor Advisory: https://github.com/pytorch/pytorch/issues/143555
Restart Required: No
Instructions:
1. Update PyTorch using pip: 'pip install torch==2.7.0' or 'pip install --upgrade torch'. 2. Verify the update with 'pip show torch'. 3. Test affected code to ensure proper behavior.
🔧 Temporary Workarounds
Input validation wrapper
allWrap bitwise_right_shift calls with validation to ensure 'other' argument is within bounds
def safe_bitwise_right_shift(tensor, other):
if other < 0 or other >= tensor.element_size() * 8:
raise ValueError('other argument out of bounds')
return torch.bitwise_right_shift(tensor, other)
🧯 If You Can't Patch
- Implement input validation for all bitwise_right_shift calls to ensure 'other' argument is within valid range
- Add monitoring for unexpected outputs from models using bitwise operations
🔍 How to Verify
Check if Vulnerable:
Check PyTorch version with 'python -c "import torch; print(torch.__version__)"' and verify it's below 2.7.0Check Version:
python -c "import torch; print(torch.__version__)"Verify Fix Applied:
After updating, test bitwise_right_shift with edge cases that previously produced incorrect output📡 Detection & Monitoring
Log Indicators:
- Unexpected errors or warnings from PyTorch bitwise operations
- Model performance degradation without clear cause
Network Indicators:
- None - this is a local computation vulnerability
SIEM Query:
Search for Python/PyTorch error logs containing 'bitwise_right_shift' or related bitwise operation errors