CVE-2025-1945
published 2025-03-10CVE-2025-1945: picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.51%
39.7th percentile
picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | >= 2.6.35 < 5.4.301 | 5.4.301 |
| linux | linux_kernel | >= 5.11.0 < 5.15.195 | 5.15.195 |
| linux | linux_kernel | >= 5.16.0 < 6.1.156 | 6.1.156 |
| linux | linux_kernel | >= 5.5.0 < 5.10.246 | 5.10.246 |
| linux | linux_kernel | >= 6.13.0 < 6.16.11 | 6.16.11 |
| linux | linux_kernel | >= 6.17.0 < 6.17.1 | 6.17.1 |
| linux | linux_kernel | >= 6.2.0 < 6.6.110 | 6.6.110 |
| linux | linux_kernel | >= 6.7.0 < 6.12.51 | 6.12.51 |
| mmaitre314 | picklescan | < 0.0.23 | 0.0.23 |
| mmaitre314 | picklescan | >= 0 < e58e45e0d9e091159c1554f9b04828bbb40b9781 | e58e45e0d9e091159c1554f9b04828bbb40b9781 |
| mmaitre314 | picklescan | >= 0 < 0.0.23 | 0.0.23 |
| mmaitre314 | picklescan | >= 0.0.1 < 0.0.23 | 0.0.23 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
media: rc: fix races with imon_disconnect()
osv·2025-10-15
CVE-2025-39993 media: rc: fix races with imon_disconnect()
media: rc: fix races with imon_disconnect()
In the Linux kernel, the following vulnerability has been resolved:
media: rc: fix races with imon_disconnect()
Syzbot reports a KASAN issue as below:
BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline]
BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627
Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465
CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433
kasan_repo
OSV
CVE-2025-1945: picklescan before 0
osv·2025-03-10
CVE-2025-1945 CVE-2025-1945: picklescan before 0
picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.
GHSA
Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
ghsa·2025-03-10
CVE-2025-1945 [MEDIUM] CWE-345 Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
### Summary
PickleScan fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.
### Details
PickleScan relies on Python’s zipfile module to extract and scan files within ZIP-based model archives. However, certain flag bits in ZIP headers affect how files are interpreted, and some of these bits cause PickleScan to fail while leaving PyTorch’s loading mechanism unaffected.
By modifying the flag_bits field
OSV
Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
osv·2025-03-10
CVE-2025-1945 [MEDIUM] Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch
### Summary
PickleScan fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.
### Details
PickleScan relies on Python’s zipfile module to extract and scan files within ZIP-based model archives. However, certain flag bits in ZIP headers affect how files are interpreted, and some of these bits cause PickleScan to fail while leaving PyTorch’s loading mechanism unaffected.
By modifying the flag_bits field
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-10
Published