Listen to this Post
The vulnerability (CWE-502) exploits how `torch.load()` uses Python’s `pickle` module by default. When `weights_only=True` is not set, `pickle` reconstructs objects by executing their `__reduce__` method. An attacker can embed a malicious class in a `.bin` or `.pt` file, defining `__reduce__` to run commands like os.system(). When a victim loads this file with a vulnerable lmdeploy function, the `pickle.load()` process within `torch.load()` deserializes the payload and executes the attacker’s code, leading to Remote Code Execution (RCE) on the host loading the model.
Platform: lmdeploy
Version: Vulnerable versions
Vulnerability: Insecure Deserialization RCE
Severity: Critical
date: 2025-12-27
Prediction: 2026-01-17
What Undercode Say:
Create malicious model file python create_malicious_checkpoint.py Execute the exploit python exploit.py
PoC: Malicious payload class
class MaliciousPayload:
def <strong>reduce</strong>(self):
return (os.system, ('malicious_command',))
Vulnerable code pattern (simplified)
torch.load("malicious_model.bin") UNSAFE
How Exploit:
Attacker creates a malicious model checkpoint file containing a pickled payload with a defined `__reduce__` method. The file is distributed via platforms like HuggingFace. When a victim uses a vulnerable lmdeploy function to load this model, the embedded code executes automatically during the deserialization process, granting the attacker RCE.
Protection from this CVE:
Apply the `weights_only=True` parameter to all `torch.load()` calls in the codebase. Migrate to using the SafeTensors (.safetensors) format for model files, which is immune to this deserialization attack. Audit and patch all identified vulnerable files.
Impact:
Remote Code Execution (RCE), leading to full system compromise, data theft, credential access, and potential lateral movement within cloud environments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
