huntr-mfv-torch-scanner-member-skip

Security PoC — torch.package scanner member-selection bypass → unconditional code execution (huntr MFV)

Security-research PoC for a huntr MFV submission. Not malware — the payload only writes a harmless /tmp marker.

model_scanskip.pt executes code at the default PackageImporter.load_pickle() while both modelscan and picklescan report no issues — because neither scanner ever parses the malicious member (modelscan selects a member's format by file extension; picklescan scans a member only if it has a pickle extension or a leading \x80). The payload is a proto-0 builtins.eval pickle stored as a non-pickle-extension member.

Environment

pip install torch==2.13.0 modelscan==0.8.8 picklescan==1.0.4   # Python 3.10

Reproduce

modelscan  -p model_scanskip.pt      # -> "No issues found! 🎉" (malicious member skipped)
picklescan -p model_scanskip.pt      # -> "Scanned files: 0, Infected files: 0"
rm -f /tmp/huntr_r2_scanskip
python load.py                        # -> marker AFTER: True, contents: PWNED_R2_SCANSKIP

Controls: controlA_proto2_storage.pt (proto-2 → picklescan catches it) and controlB_proto0_dill.zip (.dill name → modelscan catches it) prove only the specific combo (non-pickle-ext + proto-0/1) evades both. craft.py shows how the file is built.