Listen to this Post
How the CVE Works
The vulnerability stems from a parsing logic error in picklescan and modelscan when handling the `STACK_GLOBAL` opcode. The function `_list_globals` incorrectly tracks arguments for `STACK_GLOBAL` at position `n` by only checking the range from `1` to n-1, ignoring the opcode at position 0. This allows an attacker to place an argument at position 0, causing the parser to miss it. As a result, an exception is triggered (line 281 in scanner.py), leading to detection bypass. A malicious pickle file can exploit this flaw to evade security checks, including those in Hugging Face’s online scanners.
DailyCVE Form
Platform: picklescan/modelscan
Version: pre-fix commits
Vulnerability: Detection Bypass
Severity: Critical
Date: 2023-08-12
Prediction: Patch by 2023-09-01
What Undercode Say
payload = b"S'os'\nS'system'\n\x93S'ls'\n\x85R."
with open('bad_pickle.pkl', 'wb') as f:
f.write(payload)
pickle.load(open('bad_pickle.pkl', 'rb'))
How Exploit
- Craft malicious pickle with `STACK_GLOBAL` at position
0. - Upload to vulnerable scanners (picklescan/modelscan).
- Bypass detection due to parsing exception.
Protection from this CVE
- Update to patched versions.
- Modify scanner range to
range(1, n+1).
Impact
- Detection bypass in security scanners.
- Affects Hugging Face’s online scanners.
- Potential arbitrary code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
