HuggingFace Transformers Trainer Arbitrary Code Execution via Unsafe Torch Load
Overview
A critical security vulnerability exists within the HuggingFace Transformers library, specifically impacting the `Trainer` class. The `_load_rng_state()` method, located in `src/transformers/trainer.py` at line 3059, exhibits insecure deserialization practices. It directly invokes `torch.load()` without the essential `weights_only=True` argument. This omission is particularly dangerous when the library is used in conjunction with PyTorch versions prior to 2.6. In these older PyTorch versions, the `safe_globals()` context manager, intended to mitigate such risks, does not provide adequate protection. Consequently, an attacker can craft a malicious checkpoint file, commonly named `rng_state.pth`, containing arbitrary Python code. When this compromised file is loaded by a vulnerable `Trainer` instance, the embedded malicious code is executed, leading to complete system compromise. This vulnerability allows for arbitrary code execution on the server or client machine running the vulnerable Transformers version with the specified PyTorch configurations.
Affected Systems
Testing Guide
1. Verify the PyTorch version installed (`pip show torch`). If it's below 2.6, proceed. 2. Check the HuggingFace Transformers version (`pip show transformers`). If it's a version susceptible to this issue (prior to v5.0.0rc3 that supports torch>=2.2), proceed. 3. Attempt to load a known safe `rng_state.pth` file using the `Trainer` class. 4. For a controlled test, a malicious `rng_state.pth` designed to execute a simple command (e.g., `print('PWNED')` or create a dummy file) could be attempted, but this carries significant risk and should only be done in an isolated, secure environment.
Mitigation Steps
- Ensure all PyTorch installations are updated to version 2.6 or higher. - Avoid loading checkpoint files from untrusted or unverified sources. - If upgrading PyTorch is not feasible, consider restricting network access for applications processing untrusted model checkpoints. - Monitor systems for unusual process activity after loading model checkpoints.
Patch Details
v5.0.0rc3