Keras TFSMLayer allows arbitrary code execution via unsafe SavedModel loading
Overview
The `TFSMLayer` class within the `keras` package (specifically version 3.13.0) suffers from a critical security flaw. When deserializing `.keras` model files, it unconditionally loads external TensorFlow SavedModels. This occurs even when the `safe_mode` parameter is set to `True`, which is intended to prevent such behavior. The vulnerability is triggered because `safe_mode=True` does not adequately validate or sanitize the source of SavedModels. An attacker can craft a malicious `.keras` file containing a reference to an attacker-controlled SavedModel. When this file is loaded by a victim's application, the `TFSMLayer` will load and execute code from the malicious SavedModel, leading to arbitrary code execution within the context of the victim's process and privileges. The core issue lies in the `from_config()` method's failure to properly validate file paths and the improper handling of external dependencies during the deserialization process.
Affected Systems
Testing Guide
1. Create a malicious `.keras` file that references an attacker-controlled TensorFlow SavedModel. 2. Attempt to load this `.keras` file using `keras.models.load_model` in a controlled environment. 3. Observe if the attacker-controlled SavedModel is loaded and executed, indicating the presence of the vulnerability.
Mitigation Steps
* Ensure only trusted and verified `.keras` model files are loaded. * Audit and sanitize any user-provided model file paths before deserialization. * Avoid using `TFSMLayer` with untrusted model sources. * Monitor file system activity for unexpected SavedModel loading events.