Artificial Intelligence & Machine Learning
,
Next-Generation Technologies & Secure Development
Chip Manufacturer Shore Up Loose Server Ends
Artificial chip maker giant Nvidia published patches for its open-source platform allowing users to run models at scale after researchers found hackers could gain complete control of the underlying server – allowing them to steal the models, manipulate its responses and steal data.
See Also: AI Agents Demand Scalable Identity Security Frameworks
Security researchers at Wiz, the Google-acquired cloud startup said they uncovered three flaws that could be chained together to obtain remote code execution on the Nvidia Triton Inference Server.
By themselves, the flaws don’t necessarily amount to much, Wiz said. Tracked as CVE-2025-23320, CVE-2025-23319 and CVE-2025-23334, the vulnerability chain “demonstrates how a series of seemingly minor flaws can be chained together to create a significant exploit,” researchers wrote. The flaws are among the roughly 20 vulnerabilities Nvidia patched on Monday.
Researchers’ insight was to focus on the Python backend of Triton. Even AI models configured to run on a different backend might use Python for some phases of the AI inference process, Wiz said. The Python backend’s core logic is implemented in the C++ language and the inter-process communications method for translating between the two languages uses a shared memory region. An attacker could send a large remote request and trigger an error message that reveals the unique name – the key – of that memory region.
An existing Triton API giving users access to a different, pre-existing shared memory region lacked validation, meaning that attackers could provide the stolen key and gain access to a portion of server meant to be off limits to users. From there, an attack is a matter of corrupting existing data structures or sending malicious inter-process communications messages.
“As companies deploy AI and ML more widely, securing the underlying infrastructure is paramount. This discovery highlights the importance of defense-in-depth, where security is considered at every layer of an application,” Wiz wrote.