Ludwig Framework Insecure Deserialization via torch.load()
Overview
The Ludwig framework, up to and including version 0.10.4, contains a critical security vulnerability related to insecure deserialization, categorized as CWE-502. This flaw exists within the model serving component. Specifically, when a user initiates a model server using the `ludwig serve` command, the framework utilizes `torch.load()` to load model weight files. However, it fails to enforce the `weights_only=True` parameter. This default behavior permits the deserialization of arbitrary Python objects, as `torch.load()` relies on Python's `pickle` module by default. An attacker can leverage this vulnerability by crafting a malicious PyTorch model file. If this compromised file is loaded by a Ludwig model server, it can result in the execution of arbitrary code on the server's host system, potentially leading to a full system compromise. This vulnerability poses a significant risk to any environment deploying Ludwig models for serving.
Affected Systems
Testing Guide
- Create a malicious PyTorch model file that attempts to execute arbitrary code during deserialization (e.g., using `pickle` to call `os.system`). - Attempt to serve this malicious model file using `ludwig serve` on an affected version of Ludwig. - Monitor the server for any signs of code execution or unexpected behavior. - Verify that running `ludwig serve` with a known benign model file does not exhibit vulnerabilities.
Mitigation Steps
- Ensure all model weight files are from trusted sources. - Upgrade the Ludwig framework to version 0.10.5 or later. - For older versions, consider implementing custom checks or sandboxing the model serving environment. - Review deployed model files for any suspicious content before serving.
Patch Details
Ludwig framework 0.10.5