CVE-2024-11394
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into loading malicious model files in Hugging Face Transformers. Attackers can achieve remote code execution in the context of the current user. Users of Hugging Face Transformers with Trax model support are affected.
💻 Affected Systems
- Hugging Face Transformers
📦 What is this software?
Transformers by Huggingface
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running the vulnerable application, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or arbitrary code execution when users load untrusted model files from malicious sources.
If Mitigated
No impact if proper input validation and sandboxing are implemented, or if users only load trusted model files.
🎯 Exploit Status
User interaction required (loading malicious file). Exploitation is straightforward once malicious model file is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Hugging Face security advisory for specific version
Vendor Advisory: https://huggingface.co/docs/transformers/security
Restart Required: No
Instructions:
1. Check current transformers version
2. Update to latest patched version via pip: pip install --upgrade transformers
3. Verify update completed successfully
🔧 Temporary Workarounds
Disable Trax model support
allPrevent loading of Trax model files which are vulnerable to this deserialization issue
Configure application to reject Trax model files or disable Trax integration
Restrict model file sources
allOnly allow loading model files from trusted, verified sources
Implement allowlist of trusted model repositories
🧯 If You Can't Patch
- Implement strict input validation for all model files
- Run transformers in sandboxed/isolated environment with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check if using vulnerable version of transformers with Trax support enabledCheck Version:
python -c "import transformers; print(transformers.__version__)"Verify Fix Applied:
Verify transformers version is updated to patched version and test loading known safe Trax models📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution from transformers context
- Errors or warnings during model loading/deserialization
- Loading of model files from untrusted sources
Network Indicators:
- Downloads of model files from unusual/untrusted sources
- Outbound connections following model file loading
SIEM Query:
Process creation where parent process is python/transformers and command line contains suspicious arguments