-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| keras | pip | >= 3.11.0, < 3.11.3 | 3.11.3 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the Keras library's handling of model deserialization, specifically within the TorchModuleWrapper class. The core of the issue is an insecure deserialization vulnerability (CWE-502). When a Keras model containing a TorchModuleWrapper layer is loaded, the from_config method is invoked to reconstruct the layer from its configuration.
The analysis of the patch ae2652208435eae8ca30bd45ccb2430d7a25c29d reveals that the from_config method in keras/src/utils/torch_utils.py was modified. Before the patch, this method would decode and load a torch.nn.Module from the model's configuration without any safety checks, even when Keras was operating in safe_mode. The torch.load function is known to be unsafe when used on untrusted data, as it can execute arbitrary code.
An attacker could exploit this by creating a malicious Keras model file. This file would contain a TorchModuleWrapper with a specially crafted payload in the module field of its configuration. When a victim loads this malicious model, the TorchModuleWrapper.from_config function would be called, leading to the deserialization of the payload and subsequent arbitrary code execution on the victim's machine.
The patch addresses this vulnerability by adding a crucial security check. It now verifies if the in_safe_mode() flag is active. If it is, the function raises a ValueError, preventing the deserialization of the torch.nn.Module and informing the user about the potential security risk. This ensures that by default, Keras does not perform this dangerous operation, and the user must explicitly disable safe_mode to proceed, acknowledging the risk.
TorchModuleWrapper.from_configkeras/src/utils/torch_utils.py
PythonPythonOngoing coverage of React2Shell