cesnimda
9.9 KiB
P9-SEC-02 current image advisory scope
Nine upstream no-fix groups and CVE-2025-55554 have defensible “Not affected with evidence” dispositions for this exact CPU BART service path. The upstream no-fix states and55554 global patch discrepancy remain visible. These are scoped applicability conclusions, not a claim that all44 groups are globally fixed.
Inspected clean runtime image sha256:4a04ca68fa40b3ec61cb61187b339a4d2895b375b962999e974d75556b5b1331 using two successful network-none, read-only, non-root, bounded static captures. The generation capture needed one recorded repair retry because5.10 lacks optional generation/beam_search.py; initial failure and actual file membership remain in raw evidence. Runtime: torch2.13.0+cpu, Transformers5.10.0, filelock4.2.1, Hub1.33.0, tokenizers0.22.2. App hash matches the qualification checkpoint; lock hash 3a3afc529f0076a1b5d67082c9269c22c12f52c47ecf95ce0c76c37b39d8297a. Original research files remain unchanged.
The app now pins sshleifer/distilbart-cnn-12-6 at a4f8f3ea906ed274767e9906dbaede7531d660ff, explicitly rejects remote code and requests weights_only=True. Verified reference config identifies BART/BartForConditionalGeneration; actual5.10 AutoModelForSeq2SeqLM mapping selects that class. The full1,222,317,369-byte model checkpoint is absent: its expected hash is recorded, but its bytes/hash, full inference, resource use and output quality are not verified.
What changed in the installed source
Only one converter remains in the actual5.10 model tree: unrelated Gemma4. The five named vulnerable converter CLIs are absent. Transformer-XL files are removed. GLM4 is now present and Perceiver remains present, but both are absent from the seq2seq AutoModel mapping. BART tokenizer now aliases the RoBERTa backend; no Transformer-XL pickle vocabulary route exists in this flow.
PyTorch2.13 still exposes unsafe PT2 loading: export.load calls load_pt2, whose package helpers contain weights_only=False and pickle.loads. The app reaches a different boundary: Transformers load_state_dict uses safetensors or torch.load with explicit weights_only=True. There is no export.load call/model-upload API. This is actual indirect-path evidence, not merely an absent direct torch.load application search.
Ten retained alias groups
| Group / all aliases | Current scoped disposition | Actual current-source/application evidence | Limit |
|---|---|---|---|
| CVE-2025-55554 BIT-pytorch-2025-55554, PYSEC-2025-206 |
Not affected with evidence | Current BART forward, generation utils, logits processors and generation config sources contain ZERO nan_to_num calls. Beam search3278 invokes the model,3295 uses float log_softmax,3020 chooses topk indices,3023/3026 derive beam/token IDs by integer division/modulo; it does not cast sanitized float scores to long. Existing .long calls convert attention masks/beam masks, not nan_to_num results. CPU auto-compile criteria2052 exclude CPU unless explicit _compile_all_devices is configured; app passes no compile configuration. remove_invalid_values defaultsFalse and even its optional processor1674-1678 uses torch.where returning float scores, with no long cast. | Upstream issue151510 remains open and no global fix is verified. Named operation chain is excluded from this exact CPU BART entry-point; this does not prove all native numerical code correct or full trained-model inference qualified. |
| CVE-2026-4538 BIT-pytorch-2026-4538, PYSEC-2026-139 |
Not affected with evidence | Current2.13 export.load283 still calls load_pt2; pt2_archive/_package.py891-892 and949-950 explicitly load weights_only=False and978 calls pickle.loads. This is real retained unsafe functionality. App.from_pretrained uses Transformers load_state_dict337, whose .bin fallback384 calls torch.load(weights_only=weights_only); app explicitly supplies True. Neither app nor parser accepts .pt2 model uploads or calls export.load. | Do not equate ordinary torch.load(.bin,weights_only=True) with torch.export.load(.pt2). No full checkpoint is needed to prove these distinct entry points; adding export/compile/package APIs invalidates the scoped exemption. |
| CVE-2025-14929 PYSEC-2025-217 |
Not affected with evidence | Five named conversion CLIs are absent from the actual5.10 wheel, including X-CLIP. The sole installed conversion script is unrelated Gemma4. AutoModelForSeq2SeqLM.from_pretrained selects an existing BART class, not a conversion script. HTTP text/uploads cannot choose an X-CLIP checkpoint conversion command. | Named script absent; no new global vendor fix claim. |
| CVE-2025-14926 PYSEC-2025-214 |
Not affected with evidence | SEW conversion script is absent. BART model initialization does not run SEW convert_config, and the service accepts no converter/model-path arguments. | Named script absent; arbitrary operator-installed conversion tooling is outside this image scope. |
| CVE-2025-14930 PYSEC-2025-218 |
Not affected with evidence | Unlike4.48.3, GLM4 modules are present in5.10. Its Glm4ForCausalLM maps to a different AutoModel family; GLM4 is absent from the seq2seq mapping. Verified pinned config declares model_type=bart and BartForConditionalGeneration. Request text cannot change config/model family. | Do not claim GLM4 code is absent or globally fixed. ZDI does not identify a precise loader function; conclusion is family/entry-point separation only. |
| CVE-2025-14920 PYSEC-2025-211 |
Not affected with evidence | Perceiver modules remain installed. Perceiver appears in generic/masked-LM/classification mappings, but not AutoModelForSeq2SeqLM mapping. Verified pinned BART config selects BART. BART tokenizer/generate do not dispatch Perceiver model parsing. | ZDI mechanism is broad; the scoped finding excludes its named architecture, not all deserialization. Shared torch.load boundary is separately patched/qualified, never assumed harmless. |
| CVE-2025-14921 PYSEC-2025-212 |
Not affected with evidence | Actual5.10 installed model inventory contains no transfo_xl package/files. The old4.48.3 unsafe TransfoXL tokenizer path no longer exists. Selected tokenizer implementation is BART/RoBERTa backend, not a pickle vocabulary tokenizer. | Code removal from this wheel is direct current-source evidence; it does not establish an upstream CVE patch release for every distribution. |
| CVE-2025-14924 PYSEC-2025-213 |
Not affected with evidence | Megatron conversion script is absent from5.10 wheel. Fixed BART loader consumes standard weights, not converter CLI inputs or Megatron checkpoint arguments. | General BART .bin loading still uses torch.load; this is a distinct patched weights_only boundary and not a Megatron conversion exemption for all code. |
| CVE-2025-14927 PYSEC-2025-215 |
Not affected with evidence | SEW-D conversion script absent. Auto seq2seq BART loader and request text do not invoke SEW-D convert_config or execute user conversion strings. | Reassess if conversion tooling or audio-model support added. |
| CVE-2025-14928 PYSEC-2025-216 |
Not affected with evidence | HuBERT conversion script absent. App exposes fixed BART text generation and separate PIL/Tesseract/pypdf extraction; no HuBERT audio conversion route. | No global vendor fix claim; boundary is named converter absence plus fixed BART dispatch. |
Acceptance criterion and remaining risk
A scoped Not affected conclusion is legitimate when the exact installed script is absent or the named API/family is excluded by fixed app calls, current loader mapping and verified pinned config, and untrusted HTTP input cannot select a different entry point. Full numerical model weights are not needed to distinguish a conversion CLI or torch.export.load from ordinary BART loading. Preserve upstream no-fix state, aliases and published severity; reopen the finding if accepted model formats, architecture, loader arguments, cache trust or packages change.
CVE-2025-55554 was reassessed after the additional generation source trace. BART forward, generation utils, logits processors and generation config contain no nan_to_num call. Beam search uses float log_softmax and topk indices with integer division/modulo, not sanitized float-to-long conversion. Existing .long calls convert masks. CPU auto-compile is excluded unless an explicit compile-all-devices config is provided; app supplies none. Even optional InfNanRemoveLogitsProcessor uses torch.where with float output, not nan_to_num().long(). These concrete entry-point facts justify scoped Not affected; synthetic finite logits alone would not. The vendor issue remains open, so no global patch claim follows.
Falsifiers: introduce a nan_to_num-to-long chain through model/generation/custom logits processing; allow user tensors/models/graphs; enable CPU compilation or change backend/device; or show that the exact named bug reaches these retained operations despite the absent chain. Any such evidence requires reopening this scoped assessment.
Existing qualification checkpoint passes are local compatibility evidence:59 sidecar tests, synthetic BART weights in safetensors and weights_only formats with the real pinned tokenizer,9 cache cases,5 parser/OCR cases and HTTP startup. This source lane ran no inference or tests. None establishes full selected-model or production acceptance. No owner risk acceptance is asserted.
Machine-readable detail, source line matches/hashes, scope criteria and all aliases: advisory-current-scope.json. Raw capture/process identity: .artifacts/p9-sec-02/current-source/. These10 groups remain part of44;109=65+44 accounting is unchanged.