Picklescan PyTorch Scan Bypass Leading to Arbitrary Code Execution
Overview
The 'scan_pytorch' function in picklescan versions prior to 1.0.3 is susceptible to a scanning bypass vulnerability. This flaw arises from the improper handling of PyTorch serialized objects, specifically when attackers leverage the '__reduce__' method in conjunction with dynamic evaluation. By crafting malicious PyTorch payloads that contain specially designed magic numbers, attackers can effectively trick picklescan into misidentifying them as safe. These deceptive payloads bypass the intended security checks of picklescan, yet retain their malicious executable nature. When such a compromised payload is subsequently loaded using PyTorch's 'torch.load()' function, it can lead to arbitrary code execution on the target system. This vulnerability poses a significant risk to systems that rely on picklescan for identifying malicious Python serialized objects, especially within environments processing PyTorch models.
Affected Systems
Testing Guide
1. Attempt to craft a malicious PyTorch payload using the '__reduce__' trick with custom magic numbers. 2. Use a picklescan version prior to 1.0.3 to scan this payload. 3. Verify if picklescan incorrectly reports the payload as safe. 4. Load the crafted payload using `torch.load()` in a controlled environment. 5. Observe for signs of unexpected behavior or code execution.
Mitigation Steps
- Update picklescan to version 1.0.3 or later. - Sanitize and validate all incoming PyTorch serialized data before processing. - Implement additional security scanning layers for PyTorch specific payloads. - Restrict the execution context for deserialized Python objects.
Patch Details
picklescan version 1.0.3