You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|**Scikit-learn** (Python) |**CVE-2020-13092** (joblib/pickle) | Loading a model via `joblib.load` executes pickle with attacker’s `__reduce__` payload ||
### 🆕 NVIDIA Merlin Transformers4Rec RCE via unsafe `torch.load` (CVE-2025-23298)
107
+
108
+
NVIDIA’s Transformers4Rec (part of Merlin) exposed an unsafe checkpoint loader that directly called `torch.load()` on user-provided paths. Because `torch.load` relies on Python `pickle`, an attacker-controlled checkpoint can execute arbitrary code via a reducer during deserialization.
Why this leads to RCE: In Python pickle, an object can define a reducer (`__reduce__`/`__setstate__`) that returns a callable and arguments. The callable is executed during unpickling. If such an object is present in a checkpoint, it runs before any weights are used.
113
+
114
+
Minimal malicious checkpoint example:
115
+
116
+
```python
117
+
import torch
118
+
119
+
classEvil:
120
+
def__reduce__(self):
121
+
import os
122
+
return (os.system, ("id > /tmp/pwned",))
123
+
124
+
# Place the object under a key guaranteed to be deserialized early
125
+
ckpt = {
126
+
"model_state_dict": Evil(),
127
+
"trainer_state": {"epoch": 10},
128
+
}
129
+
130
+
torch.save(ckpt, "malicious.ckpt")
131
+
```
132
+
133
+
Delivery vectors and blast radius:
134
+
- Trojanized checkpoints/models shared via repos, buckets, or artifact registries
135
+
- Automated resume/deploy pipelines that auto-load checkpoints
136
+
- Execution happens inside training/inference workers, often with elevated privileges (e.g., root in containers)
137
+
138
+
Fix: Commit [b7eaea5](https://github.com/NVIDIA-Merlin/Transformers4Rec/pull/802/commits/b7eaea527d6ef46024f0a5086bce4670cc140903) (PR #802) replaced the direct `torch.load()` with a restricted, allow-listed deserializer implemented in `transformers4rec/utils/serialization.py`. The new loader validates types/fields and prevents arbitrary callables from being invoked during load.
139
+
140
+
Defensive guidance specific to PyTorch checkpoints:
141
+
- Do not unpickle untrusted data. Prefer non-executable formats like [Safetensors](https://huggingface.co/docs/safetensors/index) or ONNX when possible.
142
+
- If you must use PyTorch serialization, ensure `weights_only=True` (supported in newer PyTorch) or use a custom allow-listed unpickler similar to the Transformers4Rec patch.
143
+
- Enforce model provenance/signatures and sandbox deserialization (seccomp/AppArmor; non-root user; restricted FS and no network egress).
144
+
- Monitor for unexpected child processes from ML services at checkpoint load time; trace `torch.load()`/`pickle` usage.
K8Studio IDE empowers DevOps, DevSecOps, and developers to manage, monitor, and secure Kubernetes clusters efficiently. Leverage our AI-driven insights, advanced security framework, and intuitive CloudMaps GUI to visualize your clusters, understand their state, and act with confidence.
## VMware Tools service discovery LPE (CWE-426) via regex-based exec (CVE-2025-41244)
1727
+
1728
+
Regex-driven service discovery in VMware Tools/Aria Operations can extract a binary path from process command lines and execute it with -v under a privileged context. Permissive patterns (e.g., using \S) may match attacker-staged listeners in writable locations (e.g., /tmp/httpd), leading to execution as root (CWE-426 Untrusted Search Path).
1729
+
1730
+
Learn more and see a generalized pattern applicable to other discovery/monitoring stacks here:
## Case study: Root-owned UNIX socket signal-triggered escalation (LG webOS)
47
+
48
+
Some privileged daemons expose a root-owned UNIX socket that accepts untrusted input and couples privileged actions to thread-IDs and signals. If the protocol lets an unprivileged client influence which native thread is targeted, you may be able to trigger a privileged code path and escalate.
49
+
50
+
Observed pattern:
51
+
- Connect to a root-owned socket (e.g., /tmp/remotelogger).
52
+
- Create a thread and obtain its native thread id (TID).
53
+
- Send the TID (packed) plus padding as a request; receive an acknowledgement.
54
+
- Deliver a specific signal to that TID to trigger the privileged behaviour.
- This class of bugs arises from trusting values derived from unprivileged client state (TIDs) and binding them to privileged signal handlers or logic.
79
+
- Harden by enforcing credentials on the socket, validating message formats, and decoupling privileged operations from externally supplied thread identifiers.
80
+
81
+
## References
82
+
83
+
-[LG WebOS TV Path Traversal, Authentication Bypass and Full Device Takeover (SSD Disclosure)](https://ssd-disclosure.com/lg-webos-tv-path-traversal-authentication-bypass-and-full-device-takeover/)
0 commit comments