Mamba: Insecure Deserialization in from_pretrained() via HuggingFace Hub
Overview
The Mamba language model framework, specifically versions up to and including 2.2.6, is susceptible to an insecure deserialization vulnerability (CWE-502) when loading pre-trained models from the HuggingFace Hub. The critical vulnerability lies within the MambaLMHeadModel.from_pretrained() method. This method relies on torch.load() to load model weights from the 'pytorch_model.bin' file. Crucially, it fails to enforce the security-conscious 'weights_only=True' parameter. Consequently, this oversight permits the deserialization of arbitrary Python objects through Python's 'pickle' module. An attacker could leverage this by creating and publishing a compromised model repository on HuggingFace Hub. When an unsuspecting user attempts to load a model from this malicious repository, arbitrary code execution is facilitated on the user's system, operating under the privileges of the mamba process. This poses a significant risk to system integrity and data security.
Affected Systems
Testing Guide
1. Identify a version of Mamba prior to 2.2.7. 2. Create a dummy PyTorch model that pickles a malicious object (e.g., a payload that runs `os.system('echo vulnerable')`). 3. Upload this malicious model to a private HuggingFace Hub repository. 4. Attempt to load this model using `MambaLMHeadModel.from_pretrained('your-username/malicious-model')` within a Mamba application. 5. Observe if the malicious payload executes (e.g., the echo command output appears in the terminal).
Mitigation Steps
* Update Mamba to the latest version (>= 2.2.7). * Always verify the source of pre-trained models before loading them. * Consider using alternative model loading methods that explicitly disable pickle if possible. * Implement strict code review for model loading procedures within applications. * Run Mamba in a sandboxed or containerized environment with limited privileges.
Patch Details
Version 2.2.7