CosyVoice insecure deserialization via PyTorch .pt file loading
Overview
The CosyVoice project, specifically prior to commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e, is vulnerable to arbitrary code execution due to an insecure deserialization flaw in its `make_parquet_list.py` script. This script processes PyTorch `.pt` files, which can contain serialized data such as utterance embeddings, speaker embeddings, and speech tokens. The vulnerability arises because `torch.load()` is used without the `weights_only=True` parameter. This omission allows the deserialization of arbitrary Python objects through the underlying `pickle` module. An attacker can leverage this by crafting malicious `.pt` files and placing them within a data directory that the CosyVoice tool is configured to process. When an unsuspecting user or system processes this compromised data directory, the malicious payload embedded within the `.pt` file will be deserialized and executed, leading to arbitrary code execution on the victim's system. This poses a significant risk to data integrity and system security.
Affected Systems
Testing Guide
* **Step 1:** Locate the `make_parquet_list.py` script in the CosyVoice repository. * **Step 2:** Examine the `torch.load()` calls within this script. * **Step 3:** Verify if the `weights_only=True` parameter is absent. If it is missing, the system is likely vulnerable. * **Step 4 (Advanced):** Create a controlled test environment. Craft a simple, malicious `.pt` file containing a payload that attempts to execute a harmless command (e.g., `import os; os.system('echo vulnerable')`). Process this file using the `make_parquet_list.py` script. Observe if the command is executed.
Mitigation Steps
* Ensure `torch.load()` is always called with `weights_only=True` when loading untrusted PyTorch models or data. * Sanitize and validate all input `.pt` files before processing them with the `make_parquet_list.py` script. * Limit the permissions of the process running the CosyVoice tool to minimize the impact of potential code execution. * Consider using alternative, safer serialization formats if possible, or implementing strict checks on the origin and integrity of `.pt` files.
Patch Details
Commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e