PyTorch Arbitrary Code Execution Vulnerability via Malicious Checkpoint Files

A vulnerability allowing arbitrary code execution has been identified in PyTorch versions prior to 2.10.0. The issue arises in the 'weights_only' unpickler, which fails to properly validate pickle opcodes and storage metadata. This flaw enables attackers to craft malicious checkpoint files (.pth) that, when loaded with 'torch.load(..., weights_only=True)', can corrupt memory and execute arbitrary code in the context of the user's process.

Impact

Exploitation of this vulnerability can lead to arbitrary code execution on the victim's machine.

Reproduction

The vulnerability can be reproduced by creating a malicious checkpoint file that exploits the unpickler's lack of validation. This crafted file can then be loaded using 'torch.load' with the 'weights_only' parameter set to True, which will trigger the memory corruption and potential code execution.

Remediation

Users should upgrade to PyTorch version 2.10.0 or later, where this vulnerability has been fixed.