Deserialization Flaw in torchdistill up to 1.1.5

Executive Summary

This vulnerability is a deserialization flaw in the torchdistill framework up to version 1.1.5. It occurs in the load_ckpt function of torchdistill/common/main_util.py. The issue arises when the src_ckpt argument is manipulated, allowing deserialization of malicious payloads. This happens because the function uses torch.load with weights_only=False, bypassing PyTorch's secure default that prevents arbitrary code execution during deserialization.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious checkpoint files in your torchdistill configurations or PyTorch model directories. Look for YAML files referencing src_ckpt with untrusted paths. Use grep to search for 'src_ckpt' in config files. Monitor for unexpected file creation or process execution during model loading.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows local attackers to execute arbitrary code on your system. If you use torchdistill with untrusted checkpoint files or third-party model configurations, an attacker could craft a malicious checkpoint that runs code when loaded. This could lead to data theft, system compromise, or further network attacks depending on the executed payload.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized data access or exfiltration. GDPR requires protection against unauthorized processing, while HIPAA mandates safeguards for protected health information. A successful exploit could result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update PyTorch to version 2.6 or later. Remove any explicit weights_only=False settings in load_ckpt(). Avoid using untrusted checkpoint files or third-party model configs. Validate all src_ckpt paths in YAML files before loading.

Useful 0 Not Useful 0