Описание
The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization vulnerability (CWE-502) in its Kubeflow component's model loading functionality. When loading model weights from a file (e.g., model.pt) during robustness evaluation, the code uses torch.load() without the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the Pickle module. An attacker can exploit this by uploading a maliciously crafted model file to an object storage location referenced by the pipeline, or by controlling the model_id parameter to point to such a file. When the pipeline loads the model, the malicious payload is executed, leading to remote code execution.
A flaw was found in the Adversarial Robustness Toolbox (ART), specifically within its Kubeflow component. This vulnerability, categorized as insecure deserialization (CWE-502), occurs when loading model weights without proper security restrictions. A remote attacker can exploit this by uploading a maliciously crafted model file or by controlling a parameter to point to such a file. Successful exploitation allows for the execution of arbitrary code on the affected system, leading to remote code execution.
Отчет
Important: This flaw is not present in Red Hat products as the vulnerable code is not in the execution path. The Adversarial Robustness Toolbox (ART) Kubeflow component contains an insecure deserialization vulnerability that could lead to remote code execution through maliciously crafted model files. However, Red Hat OpenShift AI (RHOAI) components are not affected because the vulnerable code is not executed in their deployment.
Меры по смягчению последствий
To mitigate this issue, restrict access to object storage locations used by Kubeflow pipelines to trusted sources only. Implement strict validation and integrity checks for all model files before they are loaded into the Adversarial Robustness Toolbox within a Kubeflow environment. Ensure that only models from verified and trusted origins are processed. This reduces the risk of an attacker introducing a maliciously crafted model file.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-agent-rhel9 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-controller-rhel9 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-router-rhel9 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-kserve-storage-initializer-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization vulnerability (CWE-502) in its Kubeflow component's model loading functionality. When loading model weights from a file (e.g., model.pt) during robustness evaluation, the code uses torch.load() without the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the Pickle module. An attacker can exploit this by uploading a maliciously crafted model file to an object storage location referenced by the pipeline, or by controlling the model_id parameter to point to such a file. When the pipeline loads the model, the malicious payload is executed, leading to remote code execution.
The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization vulnerability (CWE-502) in its Kubeflow component's model loading functionality. When loading model weights from a file (e.g., model.pt) during robustness evaluation, the code uses torch.load() without the security-restrictive weights_only=True parameter. This allows the deserialization of arbitrary Python objects via the Pickle module. An attacker can exploit this by uploading a maliciously crafted model file to an object storage location referenced by the pipeline, or by controlling the model_id parameter to point to such a file. When the pipeline loads the model, the malicious payload is executed, leading to remote code execution.
EPSS
8.8 High
CVSS3