Tencent TFace Deserialization Vulnerability Leading to Remote Code Execution

A remote code execution vulnerability has been identified in Tencent TFace, specifically within the eval endpoint. This issue arises from improper validation of user-supplied data, allowing for the deserialization of untrusted data. As a result, remote attackers can execute arbitrary code on the affected system with root privileges. Exploitation requires user interaction, as the target must visit a malicious page or open a harmful file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the root user.

Reproduction

To reproduce this vulnerability, a user must be convinced to visit a malicious webpage or open a harmful file that exploits the deserialization flaw in the eval endpoint of Tencent TFace. Once the untrusted data is deserialized, the attacker can execute arbitrary code on the system with root privileges.

Remediation

Tencent has released a patch for this vulnerability. Users can refer to the Tencent TFace GitHub repository for the update.