Описание
A vulnerability in the TFSMLayer class of the keras package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of .keras models, even when safe_mode=True. This bypasses the security guarantees of safe_mode and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the from_config() method.
A flaw was found in the keras package. This vulnerability allows an attacker to execute unauthorized code on a victim's system. It occurs when a victim loads a specially crafted .keras model, even if the safe_mode security feature is active. The issue arises because the keras package can unconditionally load external TensorFlow SavedModels without sufficient validation, thereby bypassing the intended security protections and leading to arbitrary code execution.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-agent-rhel9 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-controller-rhel9 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-router-rhel9 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-storage-initializer-rhel9 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-modelmesh-runtime-adapter-rhel8 | Affected | ||
| Red Hat OpenShift AI 2.25 | rhoai/odh-modelmesh-runtime-adapter-rhel9 | Fixed | RHSA-2026:24977 | 10.06.2026 |
| Red Hat OpenShift AI 3.3 | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | Fixed | RHSA-2026:37275 | 09.07.2026 |
| Red Hat OpenShift AI 3.3 | rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | Fixed | RHSA-2026:37275 | 09.07.2026 |
| Red Hat OpenShift AI 3.3 | rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | Fixed | RHSA-2026:37275 | 09.07.2026 |
| Red Hat OpenShift AI 3.3 | rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | Fixed | RHSA-2026:37275 | 09.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `safe_mode` and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the `from_config()` method.
A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`. This bypasses the security guarantees of `safe_mode` and enables arbitrary attacker-controlled code execution during model inference under the victim's privileges. The issue arises due to the unconditional loading of external SavedModels, serialization of attacker-controlled file paths, and the lack of validation in the `from_config()` method.
A vulnerability in the `TFSMLayer` class of the `keras` package, versi ...
Keras has an untrusted deserialization vulnerability
EPSS
7.8 High
CVSS3