Picklescan fails to detect pickle files with non-standard extensions
Picklescan before 0.0.22 only scans pickle files with standard extensions (.pkl, .pt), allowing attackers to embed malicious pickle files with non-standard extensions inside model archives that evade detection. PyTorch's pickle_file parameter enables loading alternative pickle files from within a model, making this a potential supply-chain attack vector for compromised ML models.
What happened
Picklescan before version 0.0.22 identifies pickle files only by their standard file extensions (.pkl, .pt) when scanning for security vulnerabilities. PyTorch's torch.load() function accepts a pickle_file parameter that allows specifying an alternative pickle file to load from within a model archive, even if it has a non-standard extension such as .p or .config.
An attacker can exploit this by creating a PyTorch model that embeds a malicious pickle file with a non-standard extension alongside a benign primary data.pkl file. When the model is loaded, the embedded malicious pickle file is deserialized and executed, but Picklescan does not detect it because it does not scan files outside standard extensions.
Reported impact
The vulnerability enables supply-chain attacks against organizations that share or download machine learning models from repositories. Malicious code can be executed when a compromised model is loaded, potentially leading to remote code execution on systems that trust the scanned model.
Index analysis
Picklescan relies on file extension patterns to identify pickle files in scope for security scanning. PyTorch's flexible pickle_file parameter was not considered in the tool's threat model, creating a gap between the scanning scope and the actual attack surface.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.