Listen to this Post
How the CVE Works
The vulnerability stems from an inconsistency in OperatorFuncNode, which allows untrusted `operator.xxx` methods to execute while appearing harmless. During model loading, `get_untrusted_types` checks the concatenation of `__module__` and `__class__` keys, but `OperatorFuncNode` only uses `__class__` to invoke operator.class_name. An attacker can craft a `schema.json` with a benign-looking `__module__` (e.g., sklearn.linear_model._stochastic_gradient.SGDRegressor) and a malicious `__class__` (e.g., call), tricking the loader into approving `sklearn.linear_model…call` while executing operator.call. This enables code reuse attacks, such as invoking `skops.io.loads` with a hidden malicious payload, leading to arbitrary code execution.
DailyCVE Form
Platform: skops
Version: <=0.11.0
Vulnerability: Arbitrary Code Execution
Severity: Critical
Date: 2023-12-14
Prediction: Patch by 2024-01-15
What Undercode Say
Malicious schema.json snippet
{
"<strong>class</strong>": "call",
"<strong>module</strong>": "sklearn.linear_model._stochastic_gradient.SGDRegressor",
"<strong>loader</strong>": "OperatorFuncNode"
}
Loader check bypass
untrusted_types = get_untrusted_types(file="model.skops") Returns misleading trusted types
load("model.skops", trusted=untrusted_types) Executes operator.call
Exploit
- Craft `schema.json` with deceptive `__module__` and `operator.call` as
__class__.
2. Embed a secondary payload (`my-model-evil.skops`) invoking `builtins.exec`.
- Trigger load chain via `skops.io.loads` with attacker-controlled trusted list.
Protection from this CVE
- Patch `OperatorFuncNode` to validate actual called methods.
- Restrict default trusted types.
- Audit
__module__/__class__consistency.
Impact
- Arbitrary code execution at load time.
- Bypasses trusted-type checks via misleading names.
- High risk in collaborative ML environments.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
