CVE-2026-49121: AITER Unauthenticated Remote Code Execution in ROCm Inference

Technical summary

AITER's MessageQueue.recv() function in shm_broadcast.py fails to validate or authenticate incoming messages on a ZMQ SUB socket. The function deserializes untrusted pickle payloads without HMAC validation or format checking. An attacker capable of reaching the writer XPUB endpoint or supplying a forged Handle with an attacker-controlled remote_subscribe_addr can inject a malicious pickle object. Upon deserialization, the payload executes arbitrary code in the context of the inference worker process. The ZMQ SUB-XPUB architecture means a single malicious message can propagate execution across all reader workers in the cluster.

Business impact

Compromise of AITER inference clusters enables attackers to steal model weights, training data, and inferences; inject backdoors into model predictions; corrupt or delete models; or launch further attacks against internal infrastructure. For organizations running ROCm-accelerated AI workloads, this creates risk of intellectual property theft, service disruption, and potential supply-chain contamination if affected models are redistributed. The impact scales with cluster size and the sensitivity of models and data processed.

Affected systems

AMD AITER versions 0.1.14 and earlier are affected. Organizations using ROCm-based inference clusters, particularly those running distributed inference workloads on AMD GPUs, should audit their AITER deployments. The vulnerability is most exploitable in environments where cluster network access is shared or insufficiently segmented from untrusted networks.

Exploitability

The attack requires network access to the ZMQ SUB socket or the ability to forge and inject a Handle with malicious remote_subscribe_addr. In segmented, air-gapped cluster environments, exploitability is lower. However, in cloud-hosted or multi-tenant ROCm clusters, or where cluster networks are accessible from less-trusted zones, the attack surface is substantially higher. No user interaction or special conditions are required once network access is achieved. The attack complexity is rated 'High' primarily due to the requirement to reach specific internal endpoints, but the ease of pickle exploitation once those endpoints are reached is a significant concern.

Remediation

Upgrade AITER to a version newer than 0.1.14 that implements message authentication and validation. Verify against the AMD/ROCm vendor advisory for the exact patched version. Until patches are applied, implement network segmentation to restrict access to ZMQ endpoints to trusted hosts only, monitor inter-worker communication for suspicious pickle deserialization patterns, and consider disabling remote inference features if not actively required.

Patch guidance

Check the AMD ROCm and AITER release notes for versions beyond 0.1.14. Apply patches promptly to all nodes in your AITER clusters. Before patching, test in a non-production environment to ensure compatibility with your inference workloads and any custom configurations. Consider staggered rollouts to avoid service interruption.

Detection guidance

Monitor ZMQ socket activity for unexpected connections to SUB sockets from untrusted IP ranges. Log and alert on deserialization of pickle objects in MessageQueue.recv() if instrumentation is available. Use network taps or host-based monitoring to detect anomalous inter-worker communication patterns. Check for fork() or exec() system calls originating from AITER worker processes that deviate from normal inference patterns. Correlation of these signals across multiple workers may indicate a propagated attack.

Why prioritize this

This vulnerability merits immediate attention due to its combination of high impact (remote code execution as the inference worker), lack of authentication barriers, and potential for cluster-wide exploitation. Although network access is required, the criticality of inference infrastructure and the richness of potential targets in AITER deployments (models, training data, GPU resources) justify treating this as a near-critical risk. Organizations should prioritize patching AITER deployments before addressing lower-severity vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects remote code execution with no privileges or user interaction required, balanced against the 'High' attack complexity stemming from the need to reach internal cluster endpoints. The vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) captures complete confidentiality, integrity, and availability impact. In practice, organizations with strict network boundaries may experience lower risk; those with less segmentation face substantially higher risk.

Frequently asked questions