CVE-2024-11394: Hugging Face Transformers deserialization of untrusted data in model files

CVE-2024-11394 · Severity: high · CVSS 8.8 · Published 2024-11-23

Hugging Face Transformers is a popular machine learning library used to work with pre-trained AI models. A vulnerability in how the library loads model files allows an attacker to execute arbitrary code on a user's system when they open a malicious model file. This could lead to data theft, system compromise, or use of the compromised machine for further attacks. The vulnerability requires the user to manually open a malicious file, but this is a common workflow for data scientists and developers working with ML models.

Technologies: Hugging Face Transformers, transformers (PyPI). Vendors: Hugging Face, PyPI.

Quick answers

Is CVE-2024-11394 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-11394 being exploited in the wild.
How severe is CVE-2024-11394?
High severity, with a CVSS score of 8.8, published 23 November 2024.
Which products and versions are affected?
Hugging Face Transformers >= 0, < 4.48.0; transformers (PyPI) ECOSYSTEM:introduced=0,fixed=4.48.0.
Is there a fix for CVE-2024-11394?
Yes. transformers (PyPI): upgrade to 4.48.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-11394 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-11394?
Check whether you run Hugging Face Transformers or transformers (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • transformers (PyPI): upgrade to 4.48.0 or later
    pip install "transformers>=4.48.0"

Technical details

The vulnerability exists in the Hugging Face Transformers library's handling of model files, specifically in the deserialization of Trax models. The library fails to properly validate user-supplied model data before deserializing it, allowing an attacker to craft a malicious model file containing arbitrary Python code. When a user loads the model using the library's standard functions, the untrusted data is deserialized, resulting in arbitrary code execution in the context of the user's Python process. The attack requires user interaction (downloading and opening a malicious model file), but no special privileges. The vulnerability was addressed in version 4.48.0 by removing conversion scripts from release wheels and implementing safer model loading practices.

Affected products

  • Hugging Face Transformers >= 0, < 4.48.0

Identifiers

  • CVE-2024-11394
  • GHSA-hxxf-235m-72v3
  • PYSEC-2024-229

Timeline

  • 2024-09-13: disclosed: Vulnerability reported to vendor via bug bounty platform
  • 2024-10-14: other: Vendor rejected the vulnerability
  • 2024-11-06: other: ZDI notified vendor of intention to publish as 0-day advisory
  • 2024-11-19: advisory: Coordinated public release of ZDI advisory ZDI-24-1515
  • 2024-11-23: advisory: GitHub Advisory published for CVE-2024-11394
  • 2024-12-17: patched: Fix merged in PR #35296; patch available in version 4.48.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.