huntr-mfv-torch-package-scanner-evasion

Security PoC — torch.package model-scanner evasion (huntr MFV)

This is a security-research proof-of-concept for a huntr Model File Vulnerabilities (MFV) submission. It is not malware — the payload only writes a harmless marker to /tmp (echo/id). Do not modify to run real commands.

What it demonstrates

Loading malicious_pkgmod.pt with the default torch.package.PackageImporter(...).load_pickle() API executes code, while modelscan and picklescan scan the file and report no issues — a model-scanner false-negative. The malicious logic lives in packaged module source (benignmod.py), executed via find_class → import_module → compile(..., "exec"); the embedded pickle carries no dangerous opcodes (GLOBAL benignmod.Widget + STOP).

Environment

pip install torch==2.13.0 modelscan==0.8.8 picklescan==1.0.4   # Python 3.10+

Reproduce

# scanners report CLEAN even though they scan the embedded pickle
modelscan  -p malicious_pkgmod.pt      # -> "No issues found! 🎉"
picklescan -p malicious_pkgmod.pt      # -> "Infected files: 0, Dangerous globals: 0"

# default-API load executes code
rm -f /tmp/huntr_pkgmod_pwned
python load_pkgmod.py                   # -> marker: True  pwned-pkgmod-<user>
cat /tmp/huntr_pkgmod_pwned

Control: the naive __reduce__/posix.system variant of the same archive is flagged CRITICAL by both scanners — proving the evasion is specific to the module-source technique, not an unsupported-format skip.

Files: malicious_pkgmod.pt (PoC), build_malicious_pkgmod.py (craft), load_pkgmod.py (loader), ref_interned.pt (benign reference).