Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| keras | pip | < 3.12.3 | 3.12.3 |
| keras | pip | >= 3.13.0, < 3.15.0 | 3.15.0 |
Miggo AIRoot Cause AnalysisThe vulnerability described is an insecure deserialization issue in Keras when handling model configurations. The analysis of the provided patches confirms this. The two commits, 55888d3becbdbb45dc16a55b489900f911e2dde5 and d338a45204bdc787c8b3c4a9b82c1911cd52dedf, both address this issue by modifying the from_config methods in TorchModuleWrapper and Lambda layers.
The core of the vulnerability is that these methods did not correctly enforce 'safe mode' when deserializing. The original code used checks like if in_safe_mode(): or safe_mode = safe_mode or serialization_lib.in_safe_mode(), which failed to prevent deserialization when no explicit safe mode was set. This 'fail-open' behavior allowed for the deserialization of potentially malicious data, leading to arbitrary code execution.
The patches correct this by ensuring that safe mode is treated as enabled by default if not explicitly disabled. This 'fail-closed' approach prevents the unsafe deserialization from occurring unless the user has explicitly opted into an unsafe mode.
The identified vulnerable functions, TorchModuleWrapper.from_config and Lambda.from_config, are the exact locations where this unsafe deserialization occurs and where the patches were applied. Therefore, these are the functions that would appear in a runtime profile during the exploitation of this vulnerability.
TorchModuleWrapper.from_configkeras/src/utils/torch_utils.py
Lambda.from_configkeras/src/layers/core/lambda_layer.py