Exploiting Pickle Deserialization Vulnerability in Transformers

Experiment Introduction

Introduces the pickle deserialization mechanism and its __reduce__ attack principle, reproduces the deserialization vulnerability CVE-2024-3568 in the Hugging Face Transformers library, analyzes security risks in the Transformers library, and proposes effective security hardening measures. For details, please refer to the experiment PDF document.

(PoC author code is available at CVE-2024-3568 or in the author_inf folder)

Key Information

1. Vulnerability Location TFAutoModel.load_repo_checkpoint() method (Transformers ≤ v4.37.2)

2. Attack Principle The extra_data.pickle file in a malicious checkpoint triggers RCE when deserialized via pickle.load()

3. Impact Scope

• Transformers library ≤ v4.37.2
• AI applications using checkpoint restoration functionality

Environment Setup

# For detailed configuration instructions, see the experiment PDF
pip install transformers==4.37.2 tensorflow
git clone https://github.com/llm-sec/transformer-hacker

Pickle Deserialization Mechanism

For details, see the PDF document.

test.py and test2.py involve principle analysis (with assistance from AI Wenxiaobai; thanks to the productivity gains from technological breakthroughs).

Vulnerability Reproduction

1. Malicious Checkpoint Generation (For specific commands, see the PDF document)

2. Vulnerability Triggering (For code examples, see the PDF document)

3. Attack Verification (For verification methods, see the PDF document)

Defense Measures

1. Upgrade Transformers to ≥ v4.38.0
2. Disable the load_repo_checkpoint() method
3. Implement checkpoint file validation

Detailed Technical Analysis: For the complete vulnerability principle, exploitation process, and defense strategies, please refer to the experiment PDF document PoC Implementation: PoC author code is available at CVE-2024-3568 or in the author_inf folder