Insecure Deserialization in ml-engineering torch-checkpoint-shrink.py
Overview
The `torch-checkpoint-shrink.py` script within the `ml-engineering` project, specifically in commit `0099885db36a8f06556efe1faf552518852cb1e0` (dated 2025-20-27), is susceptible to an insecure deserialization vulnerability (CWE-502). The vulnerability stems from the improper use of `torch.load()` when processing PyTorch checkpoint files (`.pt`). The `weights_only=True` parameter, which enforces a security-restrictive loading of only tensor data, is not enabled. This omission allows the script to deserialize arbitrary Python objects embedded within the checkpoint file via the underlying `pickle` module. Consequently, a remote attacker capable of supplying a specially crafted checkpoint file can leverage this flaw to achieve arbitrary code execution with the privileges of the user running the script. This poses a significant risk, as it can lead to full system compromise if the script is executed with elevated permissions.
Affected Systems
Testing Guide
1. Locate the `torch-checkpoint-shrink.py` script in the specified `ml-engineering` commit. 2. Examine the `torch.load()` calls within the script. Verify if the `weights_only=True` parameter is consistently passed. 3. If `weights_only=True` is not used, the script is potentially vulnerable. 4. To test exploitation, create a malicious `.pt` file containing a pickled payload that executes arbitrary code (e.g., a simple `os.system('echo "Vulnerable"')`). Attempt to process this file using the script.
Mitigation Steps
* Ensure `weights_only=True` is passed to `torch.load()` when loading checkpoint files from untrusted sources. * Validate the integrity and origin of all PyTorch checkpoint files before loading them. * Avoid loading checkpoint files from external or untrusted repositories. * Regularly update dependencies, including PyTorch and any related ML engineering libraries, to their latest secure versions.