CVE-2024-31583: PyTorch Use-After-Free Vulnerability

CVE-2024-31583 Overview

CVE-2024-31583 is a use-after-free vulnerability in PyTorch versions prior to v2.2.0. The flaw resides in torch/csrc/jit/mobile/interpreter.cpp, the component responsible for executing serialized mobile models through the JIT lite interpreter. An attacker who can convince a user to load a crafted mobile model file can trigger memory corruption in the interpreter's operator dispatch path. Successful exploitation can lead to arbitrary code execution in the context of the process loading the model. The issue is tracked under CWE-416 (Use After Free) and was addressed by upstream commit 9c7071b0e324f9fb68ab881283d6b8d388a4bcd2.

Critical Impact
A malicious PyTorch mobile model can trigger a heap use-after-free in the JIT lite interpreter, enabling local code execution with full confidentiality, integrity, and availability impact.

Affected Products

PyTorch versions prior to v2.2.0
PyTorch mobile JIT lite interpreter (torch/csrc/jit/mobile/interpreter.cpp)
Python applications and mobile runtimes embedding vulnerable PyTorch builds

Discovery Timeline

2024-04-17 - CVE-2024-31583 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31583

Vulnerability Analysis

The vulnerability lives inside the mobile JIT lite interpreter loop that dispatches bytecode operators. When PyTorch loads a serialized mobile model, each bytecode instruction contains an operator index inst.X used to look up the callable inside code.operators_. The pre-patch code did not validate that inst.X fell within the bounds of the code.operators_ vector before dereferencing it. A crafted model containing a negative or oversized inst.X value causes the interpreter to read past the end of the heap-allocated operator table, producing a read-heap-use-after-free reported by upstream fuzzing (fuzz_torch_jit_lite_interpreter). Because operator dispatch invokes the resulting function pointer with an attacker-influenced stack, the primitive can be escalated toward arbitrary code execution in the host process.

Root Cause

The root cause is missing bounds validation on the operator index inst.X inside the interpreter's main dispatch loop. The code.operators_ container is populated during model deserialization, and the interpreter trusted the serialized index without verifying it against the container size or checking for negative values.

Attack Vector

Exploitation requires local access and user interaction: a victim must load an attacker-supplied .ptl or equivalent PyTorch mobile model. This scenario is realistic for machine-learning pipelines that ingest third-party models from public hubs, shared datasets, or supply-chain artifacts.

cpp

              mobile_debug_info->setOpIdx(pc);
            }
          }
-
+          if (inst.X < 0 ||
+              static_cast<size_t>(inst.X) >= code.operators_.size()) {
+            throw JITException("Invalid OP Instruction");
+          }
          RECORD_EDGE_SCOPE_WITH_DEBUG_HANDLE_AND_INPUTS(
              code.op_names_[inst.X].name, debug_handle, stack);
          code.operators_[inst.X](stack);

Source: PyTorch commit 9c7071b0. The patch adds a bounds check that raises a JITException before the out-of-range operator lookup and invocation occur.

Detection Methods for CVE-2024-31583

Indicators of Compromise

Python or mobile runtime processes crashing with SIGSEGV or ASAN heap-use-after-free reports originating from torch::jit::mobile::InterpreterState::run.
Loading of untrusted .ptl, .bc, or serialized mobile model files from external sources, temp directories, or user downloads.
Unexpected child processes or shell spawns from Python interpreters running PyTorch inference workloads.

Detection Strategies

Inventory Python environments and containers for torch package versions below 2.2.0 using pip list or SBOM tooling.
Enable AddressSanitizer or the fuzz harness fuzz_torch_jit_lite_interpreter in CI to catch malformed model files before deployment.
Monitor endpoint telemetry for PyTorch processes that deserialize models from user-writable or network-mounted paths.

Monitoring Recommendations

Alert on file writes of PyTorch mobile model artifacts to directories consumed by production inference services.
Track process lineage where python or model-serving binaries load PyTorch and then execute non-standard child processes.
Correlate application crash telemetry with model ingestion events to identify potential exploitation attempts.

How to Mitigate CVE-2024-31583

Immediate Actions Required

Upgrade PyTorch to v2.2.0 or later across all Python environments, containers, and mobile builds.
Audit ML pipelines and disallow loading of PyTorch mobile models from untrusted or unauthenticated sources.
Rebuild any downstream artifacts (wheels, container images, mobile apps) that statically embed the vulnerable interpreter.

Patch Information

The fix is upstream commit 9c7071b0e324f9fb68ab881283d6b8d388a4bcd2, first shipped in PyTorch v2.2.0. It adds explicit validation of inst.X against code.operators_.size() and throws a JITException on out-of-range indices. See the PyTorch commit details and the vulnerable source line for reference.

Workarounds

Restrict torch.jit.mobile._load_for_lite_interpreter calls to models signed and validated by your organization.
Execute untrusted model inference inside sandboxed containers with seccomp and no outbound network access.
Apply the upstream patch as a backport to internal forks that cannot immediately move to v2.2.0.

bash

# Upgrade PyTorch to a fixed release
pip install --upgrade "torch>=2.2.0"

# Verify the installed version
python -c "import torch; print(torch.__version__)"

# Optional: pin the fixed version in requirements.txt
echo "torch>=2.2.0" >> requirements.txt