Keras Lambda layer marshalled-code RCE
Date: 2024-04
Affected: keras < 2.13 / tensorflow
Attack vector: deserialization
Category: real-world
Severity: Critical
CVE: CVE-2024-3660
CWE: CWE-94
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Arbitrary code injection in TensorFlow Keras (<2.13) via Lambda-layer deserialization of marshalled Python code embedded in model files. Subsequent research demonstrated bypasses of the safe_mode mitigation.


Mitigations:

Architectural layers (MAESTRO):