AI Tensor Engine for ROCm (AITER) - MessageQueue.recv() in shm_broadcast.py: MULTI-TENANT ISOLATION: AITER's

Impact

MULTI-TENANT ISOLATION: AITER's MessageQueue.recv() deserialises whatever arrives on a ZeroMQ SUB socket with Python pickle, so anyone who can reach that socket gets **unauthenticated remote code execution** as the process running the ROCm inference or training job. This is the highest-value AMD-stack finding for an AI operator in the whole set: it needs no local access, no privilege and no GPU device handle - just network reach to a port that distributed ROCm jobs open between workers. If your tensor-parallel or pipeline-parallel workers talk over an unauthenticated ZMQ fabric on a shared cluster network, another tenant on that network owns your jobs.

Who can reach it

Network. Unauthenticated. The attacker needs only IP reachability to the ZMQ SUB socket that AITER opens for shared-memory broadcast between distributed workers. On a flat cluster network - which is the norm for RDMA/RoCE training fabrics - that means any other tenant on the fabric. Affects AITER through 0.1.14.

What to do

Upgrade AITER past 0.1.14. Independently of the patch, fix the exposure: bind the ZMQ sockets to localhost or the job's private network namespace rather than 0.0.0.0, put distributed-training traffic on a per-job network segment, and enforce that with NetworkPolicy or equivalent so worker-to-worker ports are not reachable across tenants. No driver reload, no reboot, no firmware - this is an application and network-segmentation fix, which also means your firmware and kernel patch tooling will never surface it. Audit the rest of your stack for the same pattern: pickle-over-socket is endemic in distributed ML frameworks.

References