GHSA-9pf3-7rrr-x5jh: lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()
SummaryAn insecure deserialization vulnerability exists in lmdeploy where `torch.load()` is called without the `weights_only=True` parameter when loading model checkpoint files. This allows an attacker to execute arbitrary code on the victim's machine when they load a malicious `.bin` or `.pt` model file.**CWE:** CWE-502 - Deserialization of Untrusted DataDetailsSeveral locations in lmdeploy use `torch.load()` without the recommended `weights_only=True` security parameter. PyTorch's `torch.load()` uses Python's pickle module internally, which can execute arbitrary code during deserialization.Vulnerable Locations**1. `lmdeploy/vl/model/utils.py` (Line 22)****2. `lmdeploy/turbomind/deploy/loader.py` (Line 122)****Additional vulnerable locations:**`lmdeploy/lite/apis/kv_qparams.py:129-130``lmdeploy/lite/apis/smooth_quant.py:61``lmdeploy/lite/apis/auto_awq.py:101``lmdeploy/lite/apis/get_small_sharded_hf.py:41`Note: Secure Pattern Already ExistsThe codebase already uses the secure pattern in one location:This shows the fix is already known and can be applied consistently across the codebase.PoCStep 1: Create a Malicious Checkpoint FileSave this as `create_malicious_checkpoint.py`:Step 2: Load the Malicious File (Simulates lmdeploy's Behavior)Save this as `exploit.py`:Step 3: Run the PoCExpected OutputThe `[PoC] Arbitrary code executed!` message proves that arbitrary shell commands run during deserialization.ImpactWho Is Affected?**All users** who load PyTorch model files (`.bin`, `.pt`) from untrusted sourcesThis includes models downloaded from HuggingFace, ModelScope, or shared by third partiesAttack ScenarioAttacker creates a malicious model file (e.g., `pytorch_model.bin`) containing a pickle payloadAttacker distributes it as a "fine-tuned model" on model sharing platforms or directly to victimsVictim downloads and loads the model using lmdeployMalicious code executes with the victim's privilegesPotential Consequences**Remote Code Execution (RCE)** - Full system compromise**Data theft** - Access to sensitive files, credentials, API keys**Lateral movement** - Pivot to other systems in cloud environments**Cryptomining or ransomware** - Malware deploymentRecommended FixAdd `weights_only=True` to all `torch.load()` calls:Alternatively, consider migrating fully to SafeTensors format, which is already supported in the codebase and immune to this vulnerability class.ResourcesOfficial PyTorch Security Documentation**[PyTorch torch.load() Documentation](https://pytorch.org/docs/stable/generated/torch.load.html)***"torch.load() uses pickle module implicitly, which is known to be insecure. It is possible to construct malicious pickle data which will execute arbitrary code during unpickling. Never load data that could have come from an untrusted source."*Related CVEs| CVE | Description | CVSS |
|-----|-------------|------|
| [CVE-2025-32434](https://nvd.nist.gov/vuln/detail/CVE-2025-32434) | PyTorch `torch.load()` RCE vulnerability | **9.3 Critical** |
| [CVE-2024-5452](https://nvd.nist.gov/vuln/detail/CVE-2024-5452) | PyTorch Lightning insecure deserialization | **8.8 High** |Additional Resources[CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)[Trail of Bits: Exploiting ML Pickle Files](https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/)[Rapid7: Attackers Weaponizing AI Models](https://www.rapid7.com/blog/post/2024/02/06/attackers-are-weaponizing-ai-model-files/)Thank you for your time reviewing this report. I'm happy to provide any additional information or help with testing the fix. Please let me know if you have any questions!
CVSS v3.1: 8.8