Listen to this Post
The vulnerability stems from unsafe code execution within the `numpy.f2py.crackfortran` module. Functions such as `getlincoef` and `_eval_length` use Python’s `eval()` function on arbitrary, unvalidated string inputs derived from a processed pickle file. When a malicious pickle payload is loaded, these functions receive and execute the embedded string as Python code. This grants an attacker the ability to run arbitrary system commands on the host with the privileges of the Python process.
The flaw undermines security tools like `picklescan` designed to detect malicious pickle files. The exploit embeds its payload within the string arguments meant for these vulnerable `f2py` functions, allowing it to evade detection. Consequently, when the scanned or loaded pickle file triggers the `f2py.crackfortran` functions, the hidden payload executes. This creates a significant supply chain risk, as infected pickle files can be distributed within ML models, APIs, or serialized Python objects, leading to remote code execution upon loading.
Platform: NumPy (f2py)
Version: (multiple versions)
Vulnerability: Unsafe deserialization via `eval()`
Severity: Critical
Date: 2025-12-29
Prediction: 2026-02-15
What Undercode Say:
Analytics:
Scanning for the vulnerability in a codebase or dependencies grep -r "from numpy.f2py.crackfortran import" /path/to/project/ grep -r "import.crackfortran" /path/to/project/ pip-audit
Example of the malicious pickle generation from the PoC
import pickle
from numpy.f2py.crackfortran import getlincoef
class EvilClass:
def <strong>reduce</strong>(self):
payload = "<strong>import</strong>('os').system('id')"
return getlincoef, (payload, [])
Create the malicious pickle
malicious_pickle = pickle.dumps(EvilClass())
How Exploit:
An attacker crafts a pickle file where the `__reduce__` method returns a tuple pointing to the vulnerable function `getlincoef` (or _eval_length) with a malicious string payload as its argument. This payload contains Python code to execute arbitrary system commands. When this pickle is loaded (e.g., during a security scan by `picklescan` or normal application deserialization), the `__reduce__` protocol triggers, calling getlincoef(payload, []). The vulnerable function then passes the attacker’s string to eval(), executing the embedded command on the host system.
Protection from this CVE:
Avoid Untrusted Pickles: Never load pickle files from untrusted sources.
Use Safe Formats: Replace pickle with safe serialization formats like JSON or NumPy’s `.npy` format without pickle support.
Sandbox Execution: Run code that processes untrusted data in a tightly restricted sandbox or container.
Update & Audit: Monitor NumPy security advisories for an official patch. Audit code for imports/use of numpy.f2py.crackfortran.
Network Security: Isolate services that must handle pickle files; restrict outbound network access.
Impact:
Remote Code Execution: Full compromise of the hosting environment.
Supply Chain Attacks: Poisoning of shared ML models or data pipelines.
Bypassed Security Tools: Evasion of malware scanners like picklescan.
Data Breach/Theft: Unauthorized access to sensitive data.
System Integrity Loss: Attacker can install persistent backdoors or ransomware.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
