CosyVoice Insecure Deserialization via PyTorch Model Averaging
Overview
CosyVoice, specifically versions up to and including commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e, suffers from a critical insecure deserialization vulnerability (CWE-502) within its `average_model.py` script. This script is designed for averaging PyTorch models. The vulnerability arises from the improper use of `torch.load()` when loading checkpoint files (named `epoch_*.pt`). By default, `torch.load()` can deserialize arbitrary Python objects, which is inherently dangerous. The `weights_only=True` parameter, introduced in PyTorch to mitigate this risk by restricting loading to only tensors, is not enabled in this script. Consequently, an attacker can craft a malicious PyTorch checkpoint file containing a serialized Python object that executes arbitrary code. If a user attempts to average models located in a directory containing such a malicious file, the `torch.load()` function will deserialize and execute the attacker's code, leading to remote code execution on the victim's machine.
Affected Systems
Testing Guide
1. Create a malicious PyTorch checkpoint file containing a Python object that executes a harmless command (e.g., `os.system('echo "Vulnerable"')`). 2. Place this malicious file in a directory. 3. Use the CosyVoice `average_model.py` script to attempt to average models from this directory. 4. Observe if the command specified in the malicious payload is executed on the system running the script. If the command executes, the system is vulnerable.
Mitigation Steps
- Ensure `weights_only=True` is used when calling `torch.load()` in `average_model.py`. - Sanitize or validate all input checkpoint files before processing them with the model averaging tool. - Restrict access to directories containing model checkpoints to trusted users and sources. - Regularly update CosyVoice to the latest secure version once a patch is released.