Zip Flag Bit Exploit Bypasses PickleScan Security Checks
PickleScan versions before 0.0.23 can be bypassed by modifying ZIP file flag bits, allowing malicious pickle files to evade detection while remaining executable by PyTorch's torch.load() function. This vulnerability could enable supply chain attacks on distributed machine learning models.
What happened
PickleScan before version 0.0.23 fails to detect malicious pickle files embedded in PyTorch model archives when specific ZIP file flag bits are modified.
By flipping bits (0x1, 0x20, or 0x40) in ZIP file headers, an attacker can embed a malicious pickle file that causes PickleScan to fail during scanning while PyTorch's torch.load() successfully loads the archive and executes the malicious code.
Reported impact
Attackers can distribute backdoored PyTorch models that evade PickleScan's security detection while remaining executable, potentially enabling supply chain attacks on machine learning platforms.
Index analysis
PickleScan relies on Python's zipfile module to extract and scan model archives, but certain flag bits in ZIP headers cause PickleScan to raise errors while PyTorch's loading mechanism ignores these flag modifications.
The vulnerability allows attackers to embed malicious pickle payloads that pass through undetected but execute arbitrary code upon model loading.
Governance controls
The vulnerability was patched in PickleScan version 0.0.23.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.