PyTorch-Lightning Insecure Deserialization via Checkpoint Loading
Overview
PyTorch-Lightning versions up to and including 2.6.0 are vulnerable to an insecure deserialization flaw (CWE-502) within their checkpoint loading functionality. The `load_from_checkpoint()` method, a standard practice for restoring saved model states, relies on `torch.load()` by default. Crucially, this internal call does not enforce `weights_only=True`, which would limit deserialization to tensors and prevent the execution of arbitrary Python code. By default, `torch.load()` utilizes Python's `pickle` module for deserialization. An attacker can craft a malicious checkpoint file containing serialized arbitrary Python objects. When a user loads this compromised checkpoint file using a vulnerable PyTorch-Lightning version, the pickled data is executed, potentially leading to arbitrary code execution (ACE) on the target system. This vulnerability poses a significant risk, especially in scenarios where checkpoint files are downloaded from untrusted sources or shared across networks.
Affected Systems
Testing Guide
1. Identify PyTorch-Lightning versions installed on your system. Check `requirements.txt` or `pip freeze` output. 2. Attempt to load a known benign checkpoint file using `pytorch_lightning.Trainer.load_from_checkpoint()` to ensure basic functionality. 3. **(Advanced/Caution)** If possible, obtain or craft a simple, non-malicious pickle payload that, when loaded, performs a harmless action (e.g., prints a string) and save it as a `.ckpt` file. 4. Load this crafted checkpoint file using `pytorch_lightning.Trainer.load_from_checkpoint()`. 5. Observe if the expected harmless action from the pickle payload occurs. If it does, the system is vulnerable.
Mitigation Steps
- Update PyTorch-Lightning to the latest secure version. - If updating is not immediately possible, avoid loading checkpoint files from untrusted or unknown sources. - When loading checkpoints, explicitly verify the origin and integrity of the file before processing. - Consider implementing custom validation logic for checkpoint contents if feasible, though this is complex. - For development and testing, consider using `torch.load(..., weights_only=True)` directly if only weights are needed, but be aware this is not a direct mitigation for the library's default behavior.
Patch Details
Versions 2.7.0 and later include fixes.