You can deploy this model and start earning money today!

jeikei97/
modelscan-pytorch-legacy-tar-unscanned

Name: modelscan-pytorch-legacy-tar-unscanned
Availability: InStock

Views

No views yet

modelscan-pytorch-legacy-tar-unscanned

Proof of concept for a scanner blind spot in legacy TAR-format PyTorch model files.

Vulnerability

PyTorch supports three on-disk serialization formats, all loadable by the same torch.load() call:

Format	File head	modelscan behavior
modern ZIP archive (default)	`PK\x03\x04`	scans embedded `data.pkl`
legacy concatenated pickles	`\x80\x02\x8a...`	scans only the first pickle frame
legacy TAR archive	`storages\x00...`	never scanned (skipped)

This PoC targets the third format.

modelscan's PyTorch scanner (scan_pytorch in modelscan/tools/picklescanner.py) contains an unimplemented TODO for tar loading:

python

should_read_directly = _should_read_directly(model.get_stream())
if should_read_directly and model.get_stream().tell() == 0:
    try:
        # TODO: implement loading from tar
        raise TarError()
    except TarError:
        # file does not contain a tar
        model.get_stream().seek(0)

magic = get_magic_number(model.get_stream())
if magic != MAGIC_NUMBER:
    return ScanResults(..., SkipCategories.MAGIC_NUMBER, "Invalid magic number", ...)

Because tar loading is never implemented, a tar-format torch file falls through to get_magic_number(). That helper disassembles pickle opcodes looking for the torch magic long, but a tar file begins with the tar header storages\x00..., so no magic is found and the entire file is skipped as "Invalid magic number" — 0 issues, 0 scanned.

Meanwhile torch.load(..., weights_only=False) fully supports this legacy tar format via _legacy_load, which extracts the members storages, tensors, and pickle and unpickles them — executing any __reduce__ payload in the pickle member.

This is distinct from the ZIP gadget-chain bypass (which scans the inner pickle but is fooled by a benign-looking gadget chain) and from the legacy concatenated-pickle first-frame bypass (which scans the first frame only). Here the file is never analyzed at all, and the payload can be the simplest, most obviously dangerous global — os.system — with no evasion needed.

Primary PoC

artifacts/legacy_tar_bypass.pt — malicious tar-format torch file

The payload is benign: on load it runs os.system("touch <marker>").

Files

make_poc.py — regenerates the artifact
verify.py — self-contained proof: shows modelscan reports 0 issues and that torch.load(..., weights_only=False) executes the payload
artifacts/legacy_tar_bypass.pt — the PoC
artifacts/reproduce_output.txt — captured verification output
artifacts/sha256sums.txt — checksums

Reproduce

bash

pip install "modelscan==0.8.8" "torch==2.13.0+cpu"
python verify.py

Expected:

[*] head: b'storages'  zip? False
[*] modelscan issues=0 scanned=0 skipped=['MAGIC_NUMBER']
[*] marker before load: False, after load: True

RESULT: REPRODUCED ✅

Impact

The file is a valid, loadable PyTorch artifact.
modelscan reports 0 issues and does not scan it at all (skipped).
torch.load(..., weights_only=False) executes attacker code at load time.

Suggested fix

Implement tar-format detection in scan_pytorch (the existing TODO) and route the pickle member through scan_pickle_bytes.
Treat "unrecognized / unscannable but loadable" PyTorch files as suspicious rather than silently skipping them.

jeikei97/modelscan-pytorch-legacy-tar-unscanned