CVE-2026-49121: AITER for ROCm RCE Vulnerability

CVE-2026-49121 Overview

CVE-2026-49121 is an unauthenticated remote code execution vulnerability in AI Tensor Engine for ROCm (AITER) through version 0.1.14. The flaw resides in the MessageQueue.recv() function within shm_broadcast.py, which deserializes attacker-controlled data from a ZeroMQ (ZMQ) SUB socket using Python pickle. The socket lacks authentication, HMAC validation, and format checks. Attackers who can reach the writer XPUB endpoint on the cluster network, or who can supply a forged Handle with an attacker-controlled remote_subscribe_addr, can deliver a malicious pickle payload. The payload executes arbitrary code on every remote reader worker simultaneously, running with the privileges of the inference worker process. This vulnerability is classified under [CWE-502: Deserialization of Untrusted Data].

Critical Impact
Unauthenticated attackers on the cluster network can execute arbitrary code on every inference worker process simultaneously by sending a crafted pickle payload to the unauthenticated ZMQ SUB socket.

Affected Products

AI Tensor Engine for ROCm (AITER) versions through 0.1.14
Deployments exposing the AITER writer XPUB endpoint on a reachable cluster network
Inference workloads using AITER MessageQueue for cross-worker broadcast

Discovery Timeline

2026-06-01 - CVE-2026-49121 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-49121

Vulnerability Analysis

AITER implements a shared-memory broadcast layer in shm_broadcast.py to coordinate inference worker processes across machines. The MessageQueue class uses ZMQ XPUB/SUB sockets to distribute serialized Python objects between a writer and remote readers. The recv() method on the subscriber side calls pickle.loads() directly on bytes pulled off the SUB socket. Python's pickle module is not safe for untrusted input. Specially crafted pickle streams invoke arbitrary callables during deserialization through __reduce__ semantics, granting code execution in the receiving process.

Because the SUB socket binds without authentication, HMAC, encryption (CurveZMQ), or message format validation, any peer that can connect to the writer's XPUB endpoint or impersonate it can deliver malicious payloads. The pickle is broadcast to all subscribers, so a single payload executes code on every reader worker concurrently.

Root Cause

The root cause is unsafe deserialization of network-sourced data combined with the absence of transport-level authentication. MessageQueue.recv() trusts the byte stream from the ZMQ SUB socket and passes it to pickle.loads() without verifying the sender, message integrity, or schema. A Handle object carrying a remote_subscribe_addr controlled by the attacker is sufficient to redirect a reader to an attacker-operated publisher.

Attack Vector

An attacker with network reachability to the AITER cluster connects to the XPUB endpoint and publishes a pickle payload whose __reduce__ method returns an arbitrary callable such as os.system or subprocess.Popen. Alternatively, the attacker injects or forges a Handle so that worker processes subscribe to an attacker-hosted endpoint. On the next recv() call, every subscribing reader deserializes the payload and executes the embedded code in the context of the inference worker process. See the VulnCheck Advisory for ROCm AITER for additional technical detail.

Detection Methods for CVE-2026-49121

Indicators of Compromise

Unexpected outbound or lateral TCP connections to or from AITER XPUB/SUB ports on inference hosts.
Inference worker processes spawning shells, Python one-liners, curl, wget, or other non-inference child processes.
Anomalous Python tracebacks referencing pickle.loads or shm_broadcast.py in worker logs.
New cron entries, SSH keys, or persistence artifacts created by the inference service account.

Detection Strategies

Inspect process trees for AITER worker processes spawning unexpected children, which strongly indicates pickle-based code execution.
Apply network detection rules to flag unauthenticated ZMQ traffic to AITER ports from hosts outside the approved inference cluster.
Hunt for the byte sequence c__builtin__\nos.system or cposix\nsystem and similar pickle opcodes in captured cluster traffic.

Monitoring Recommendations

Forward AITER worker stdout, stderr, and Python exception logs to a centralized SIEM for correlation.
Baseline normal remote_subscribe_addr values and alert on any change or unexpected peer.
Monitor for new listeners on ephemeral ports on inference nodes that could indicate attacker-hosted publishers.

How to Mitigate CVE-2026-49121

Immediate Actions Required

Restrict network access to AITER XPUB/SUB ports so only known cluster members can connect, using host firewalls or network policy.
Move AITER cluster traffic onto an isolated management network segment with no exposure to user or tenant networks.
Audit deployed AITER instances and identify any version at or below 0.1.14 for prioritized remediation.
Disable or remove AITER broadcast features in environments where multi-worker inference coordination is not required.

Patch Information

Upgrade AITER to a fixed release once available from the ROCm project. Track remediation status through GitHub Issue #3076 and GitHub Pull Request #3170. The fix replaces unsafe pickle deserialization on untrusted transport and adds authentication and integrity validation to the message queue.

Workarounds

Bind ZMQ sockets to loopback or a private interface and require CurveZMQ authentication between writer and readers.
Wrap message payloads with an HMAC and reject any frame whose signature does not validate before deserialization.
Replace pickle with a safe serialization format such as JSON, MessagePack, or Protocol Buffers for inter-worker messages.
Run inference workers under unprivileged service accounts with seccomp or AppArmor profiles that deny shell execution.

bash

# Configuration example: restrict AITER broadcast ports to the cluster subnet
iptables -A INPUT -p tcp --dport 5555:5560 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5555:5560 -j DROP